Testing authentication in FastAPI - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to import the FastAPI testing client.

FastAPI

from fastapi.testclient import [1]

Drag options to blanks, or click blank then click option'

AClientTest

BFastClient

CTestClient

DTestFastClient

Attempts:

3 left

💡 Hint

Common Mistakes

Using a wrong class name like ClientTest or FastClient.

Trying to import from fastapi.client instead of fastapi.testclient.

The TestClient is the correct class to import for testing FastAPI apps.

2fill in blank

medium

Complete the code to create a test client for the FastAPI app named 'app'.

FastAPI

client = [1](app)

Drag options to blanks, or click blank then click option'

ATestClient

BFastClient

CClientTest

DAppClient

Attempts:

3 left

💡 Hint

Common Mistakes

Using a class name that does not exist like FastClient or ClientTest.

Trying to call the app instance instead of the test client class.

You create a test client by calling TestClient with the FastAPI app instance.

3fill in blank

hard

Fix the error in the test function to send a GET request to '/login'.

FastAPI

def test_login():
    response = client.[1]('/login')
    assert response.status_code == 200

Drag options to blanks, or click blank then click option'

Aget

Bsend

Cpost

Drequest

Attempts:

3 left

💡 Hint

Common Mistakes

Using post instead of get for a GET route.

Trying to use a method named send or request which do not exist.

The method to send a GET request is get. Using post or others will not match the GET route.

4fill in blank

hard

Fill both blanks to send a POST request with JSON data to '/token'.

FastAPI

def test_token():
    response = client.[1]('/token', json=[2])
    assert response.status_code == 200

Drag options to blanks, or click blank then click option'

Apost

B{'username': 'user', 'password': 'pass'}

C{'user': 'user', 'pass': 'pass'}

Dget

Attempts:

3 left

💡 Hint

Common Mistakes

Using GET method instead of POST.

Using wrong keys in the JSON data like 'user' or 'pass'.

To send JSON data in a POST request, use post method and pass the correct dictionary with keys 'username' and 'password'.

5fill in blank

hard

Fill all three blanks to check the token response contains 'access_token' and is a string.

FastAPI

def test_token_response():
    response = client.post('/token', json={'username': 'user', 'password': 'pass'})
    data = response.json()
    assert '[1]' in data
    assert isinstance(data['[2]'], [3])

Drag options to blanks, or click blank then click option'

Aaccess_token

Btoken

Cstr

Dint

Attempts:

3 left

💡 Hint

Common Mistakes

Checking for wrong key names like 'token'.

Using int instead of str for the token type.

The response JSON should contain the key 'access_token' and its value should be a string type.

Practice

1. What is the main purpose of testing authentication in a FastAPI application?

easy

A. To improve the app's UI design

B. To speed up the server response time

C. To verify that only authorized users can access protected routes

D. To check database connection speed

Solution

1. Step 1: Understand authentication testing goal

   Authentication testing ensures users are properly verified before accessing certain parts of the app.

2. Step 2: Identify the correct purpose

   Only authorized users should access protected routes, which is what authentication testing checks.

3. Final Answer:

   To verify that only authorized users can access protected routes -> Option C

4. Quick Check:

   Authentication testing = verify authorized access [OK]

Hint: Authentication tests check user access control only [OK]

Common Mistakes:

• Confusing authentication with UI or performance testing
• Thinking authentication tests improve speed
• Mixing authentication with database tests

2. Which FastAPI tool is commonly used to simulate HTTP requests during authentication tests?

easy

A. HTTPServer

B. TestClient

C. RequestSimulator

D. AuthTester

Solution

1. Step 1: Recall FastAPI testing utilities

   FastAPI provides TestClient to simulate HTTP requests in tests easily.

2. Step 2: Match the tool to the name

   TestClient is the official tool; others are not part of FastAPI.

3. Final Answer:

   TestClient -> Option B

4. Quick Check:

   FastAPI request simulation = TestClient [OK]

Hint: Use TestClient to simulate requests in FastAPI tests [OK]

Common Mistakes:

• Using non-existent tools like HTTPServer or AuthTester
• Confusing TestClient with server components
• Not importing TestClient from fastapi.testclient

3. Given this FastAPI test code snippet, what will be the response status code when accessing a protected route without credentials?

from fastapi.testclient import TestClient
from main import app

client = TestClient(app)

response = client.get('/protected')
print(response.status_code)

medium

A. 401

B. 404

C. 200

D. 500

Solution

1. Step 1: Understand protected route behavior

   Protected routes require authentication; without credentials, access is denied.

2. Step 2: Identify expected HTTP status code

   Unauthorized access returns 401 status code, not 200 (success) or 404 (not found).

3. Final Answer:

   401 -> Option A

4. Quick Check:

   Unauthorized access = 401 status [OK]

Hint: No credentials on protected route returns 401 Unauthorized [OK]

Common Mistakes:

• Expecting 200 OK without authentication
• Confusing 401 with 404 Not Found
• Assuming server error 500 instead of auth error

4. Identify the error in this FastAPI authentication test code:

from fastapi.testclient import TestClient
from main import app

client = TestClient(app)

response = client.post('/login', json={'username': 'user', 'password': 'wrongpass'})
assert response.status_code == 200

medium

A. The TestClient import is incorrect

B. The client should use GET instead of POST

C. The JSON keys should be 'user' and 'pass' instead

D. The test expects status 200 even with wrong password

Solution

1. Step 1: Analyze expected login response

   Wrong password should cause login failure, usually status 401 or 403, not 200.

2. Step 2: Check test assertion correctness

   Asserting status 200 on wrong credentials is incorrect and will fail the test.

3. Final Answer:

   The test expects status 200 even with wrong password -> Option D

4. Quick Check:

   Wrong password should NOT return 200 [OK]

Hint: Wrong password login returns error, not 200 OK [OK]

Common Mistakes:

• Assuming POST is wrong method for login
• Using incorrect JSON keys for credentials
• Misimporting TestClient

5. You want to test a FastAPI route that requires a valid JWT token in the Authorization header. Which approach correctly simulates an authenticated request in your test?

from fastapi.testclient import TestClient
from main import app

client = TestClient(app)

# Options:
# A) client.get('/secure', headers={'Authorization': 'Bearer validtoken'})
# B) client.get('/secure')
# C) client.get('/secure', json={'token': 'validtoken'})
# D) client.get('/secure', cookies={'Authorization': 'validtoken'})

hard

A. Send the token in Authorization header with 'Bearer ' prefix

B. Send no token and expect access

C. Send token in JSON body for GET request

D. Send token as a cookie named Authorization

Solution

1. Step 1: Recall JWT token usage in HTTP requests

   JWT tokens are sent in the Authorization header with 'Bearer ' prefix for authentication.

2. Step 2: Evaluate each option's correctness

   Sending the token in the Authorization header with 'Bearer ' prefix correctly simulates authentication. No token, JSON body for GET, or cookies will fail.

3. Final Answer:

   Send the token in Authorization header with 'Bearer ' prefix -> Option A

4. Quick Check:

   JWT token in Authorization header = Send the token in Authorization header with 'Bearer ' prefix [OK]

Hint: JWT tokens go in Authorization header with 'Bearer ' prefix [OK]

Common Mistakes:

• Sending token in JSON body for GET requests
• Omitting the 'Bearer ' prefix
• Using cookies instead of headers for JWT