Testing authentication in FastAPI - Step-by-Step Execution

Concept Flow - Testing authentication

Start Test Setup

↓

Create Test Client

↓

Send Auth Request

↓

Check Response Status

↓

Verify Token

↓

End Test

This flow shows how a test client sends an authentication request, checks the response, and verifies the token if successful.

Execution Sample

FastAPI

from fastapi.testclient import TestClient
from main import app
client = TestClient(app)
def test_login():
    response = client.post('/login', json={'username':'user','password':'pass'})
    assert response.status_code == 200

This code tests the login endpoint by sending a POST request with credentials and checks if the response status is 200 (OK).

Execution Table

Step	Action	Request Data	Response Status	Response Body	Assertion
1	Create TestClient	N/A	N/A	N/A	N/A
2	Send POST /login	{'username':'user','password':'pass'}	200	{"access_token": "abc123", "token_type": "bearer"}	Check status_code == 200
3	Verify token in response	N/A	N/A	access_token present	Pass
4	Test ends	N/A	N/A	N/A	Test passed

💡 Test ends after verifying response status and token presence

Variable Tracker

Variable	Start	After Step 2	After Step 3	Final
client	None	TestClient instance	TestClient instance	TestClient instance
response	None	Response object with status 200	Response object with token	Response object with token
token	None	None	"abc123"	"abc123"

Key Moments - 2 Insights

Why do we check response.status_code before accessing the token?

Because if the status code is not 200, the response may not contain a token. Checking status_code first avoids errors and confirms the request succeeded (see execution_table step 2).

What happens if the credentials are wrong?

The response.status_code would not be 200, likely 401 or 403, so the test would fail at the assertion in step 2, stopping before token verification.

Visual Quiz - 3 Questions

Look at the execution table, what is the response status after sending the POST request?

A 500

B 200

C 401

D 404

💡 Hint

Check the 'Response Status' column at step 2 in the execution_table.

At which step do we confirm the token is present in the response?

A Step 1

B Step 2

C Step 3

D Step 4

💡 Hint

Look at the 'Action' and 'Assertion' columns in the execution_table.

If the password was incorrect, how would the assertion in step 2 change?

A It would fail because status_code would not be 200

B It would still pass because status_code is always 200

C It would pass but token would be missing

D It would raise an exception before assertion

💡 Hint

Refer to key_moments about wrong credentials and step 2 assertion.

Concept Snapshot

Testing authentication in FastAPI:
- Use TestClient to simulate requests
- Send POST with credentials to /login
- Check response.status_code == 200
- Verify access_token in response JSON
- Fail test if status or token missing

Full Transcript

This visual execution shows how to test authentication in FastAPI using TestClient. First, the test client is created. Then, a POST request is sent to the login endpoint with username and password. The response status code is checked to be 200, meaning success. Next, the test verifies that the response contains an access token. If all checks pass, the test ends successfully. If credentials are wrong, the status code would differ and the test would fail early. This step-by-step trace helps beginners understand how authentication tests run and what to check.

Practice

1. What is the main purpose of testing authentication in a FastAPI application?

easy

A. To improve the app's UI design

B. To speed up the server response time

C. To verify that only authorized users can access protected routes

D. To check database connection speed

Solution

1. Step 1: Understand authentication testing goal

   Authentication testing ensures users are properly verified before accessing certain parts of the app.

2. Step 2: Identify the correct purpose

   Only authorized users should access protected routes, which is what authentication testing checks.

3. Final Answer:

   To verify that only authorized users can access protected routes -> Option C

4. Quick Check:

   Authentication testing = verify authorized access [OK]

Hint: Authentication tests check user access control only [OK]

Common Mistakes:

• Confusing authentication with UI or performance testing
• Thinking authentication tests improve speed
• Mixing authentication with database tests

2. Which FastAPI tool is commonly used to simulate HTTP requests during authentication tests?

easy

A. HTTPServer

B. TestClient

C. RequestSimulator

D. AuthTester

Solution

1. Step 1: Recall FastAPI testing utilities

   FastAPI provides TestClient to simulate HTTP requests in tests easily.

2. Step 2: Match the tool to the name

   TestClient is the official tool; others are not part of FastAPI.

3. Final Answer:

   TestClient -> Option B

4. Quick Check:

   FastAPI request simulation = TestClient [OK]

Hint: Use TestClient to simulate requests in FastAPI tests [OK]

Common Mistakes:

• Using non-existent tools like HTTPServer or AuthTester
• Confusing TestClient with server components
• Not importing TestClient from fastapi.testclient

3. Given this FastAPI test code snippet, what will be the response status code when accessing a protected route without credentials?

from fastapi.testclient import TestClient
from main import app

client = TestClient(app)

response = client.get('/protected')
print(response.status_code)

medium

A. 401

B. 404

C. 200

D. 500

Solution

1. Step 1: Understand protected route behavior

   Protected routes require authentication; without credentials, access is denied.

2. Step 2: Identify expected HTTP status code

   Unauthorized access returns 401 status code, not 200 (success) or 404 (not found).

3. Final Answer:

   401 -> Option A

4. Quick Check:

   Unauthorized access = 401 status [OK]

Hint: No credentials on protected route returns 401 Unauthorized [OK]

Common Mistakes:

• Expecting 200 OK without authentication
• Confusing 401 with 404 Not Found
• Assuming server error 500 instead of auth error

4. Identify the error in this FastAPI authentication test code:

from fastapi.testclient import TestClient
from main import app

client = TestClient(app)

response = client.post('/login', json={'username': 'user', 'password': 'wrongpass'})
assert response.status_code == 200

medium

A. The TestClient import is incorrect

B. The client should use GET instead of POST

C. The JSON keys should be 'user' and 'pass' instead

D. The test expects status 200 even with wrong password

Solution

1. Step 1: Analyze expected login response

   Wrong password should cause login failure, usually status 401 or 403, not 200.

2. Step 2: Check test assertion correctness

   Asserting status 200 on wrong credentials is incorrect and will fail the test.

3. Final Answer:

   The test expects status 200 even with wrong password -> Option D

4. Quick Check:

   Wrong password should NOT return 200 [OK]

Hint: Wrong password login returns error, not 200 OK [OK]

Common Mistakes:

• Assuming POST is wrong method for login
• Using incorrect JSON keys for credentials
• Misimporting TestClient

5. You want to test a FastAPI route that requires a valid JWT token in the Authorization header. Which approach correctly simulates an authenticated request in your test?

from fastapi.testclient import TestClient
from main import app

client = TestClient(app)

# Options:
# A) client.get('/secure', headers={'Authorization': 'Bearer validtoken'})
# B) client.get('/secure')
# C) client.get('/secure', json={'token': 'validtoken'})
# D) client.get('/secure', cookies={'Authorization': 'validtoken'})

hard

A. Send the token in Authorization header with 'Bearer ' prefix

B. Send no token and expect access

C. Send token in JSON body for GET request

D. Send token as a cookie named Authorization

Solution

1. Step 1: Recall JWT token usage in HTTP requests

   JWT tokens are sent in the Authorization header with 'Bearer ' prefix for authentication.

2. Step 2: Evaluate each option's correctness

   Sending the token in the Authorization header with 'Bearer ' prefix correctly simulates authentication. No token, JSON body for GET, or cookies will fail.

3. Final Answer:

   Send the token in Authorization header with 'Bearer ' prefix -> Option A

4. Quick Check:

   JWT token in Authorization header = Send the token in Authorization header with 'Bearer ' prefix [OK]

Hint: JWT tokens go in Authorization header with 'Bearer ' prefix [OK]

Common Mistakes:

• Sending token in JSON body for GET requests
• Omitting the 'Bearer ' prefix
• Using cookies instead of headers for JWT