Basic authentication in Postman - Framework Patterns

Framework Mode - Basic authentication

Folder Structure

PostmanProject/
├── collections/
│   └── BasicAuthCollection.postman_collection.json
├── environments/
│   ├── dev.postman_environment.json
│   ├── staging.postman_environment.json
│   └── prod.postman_environment.json
├── globals/
│   └── globals.postman_globals.json
├── tests/
│   └── basic_auth_tests.js
├── scripts/
│   └── pre_request_scripts.js
└── README.md

Test Framework Layers

• Collections: Group of API requests using Basic Authentication headers.
• Environments: Store environment-specific variables like base URLs and credentials.
• Globals: Shared variables accessible across collections and environments.
• Tests: JavaScript test scripts validating authentication success and response correctness.
• Pre-request Scripts: Scripts to dynamically set Authorization headers before requests run.

Configuration Patterns

• Environment Variables: Store username and password as variables (e.g., username, password) in environment files to avoid hardcoding.
• Authorization Setup: Use Postman's built-in Basic Auth tab or set Authorization header dynamically in pre-request scripts using Base64 encoding.
• Multiple Environments: Separate credentials and URLs per environment (dev, staging, prod) for safe testing.
• Secure Storage: Avoid committing sensitive data to version control; use environment files locally or secure vaults.

Test Reporting and CI/CD Integration

• Use Newman (Postman's CLI) to run collections in CI/CD pipelines.
• Generate reports in formats like HTML, JSON, or JUnit for easy integration with CI tools.
• Configure CI pipelines (GitHub Actions, Jenkins, GitLab CI) to run Basic Auth tests on code push or schedule.
• Fail builds if authentication tests fail to ensure API security is maintained.

Best Practices

1. Use Environment Variables: Never hardcode credentials; always use environment variables for flexibility and security.
2. Pre-request Scripts for Auth: Use scripts to set Authorization headers dynamically to support multiple environments.
3. Validate Auth Responses: Write tests to check for HTTP 200 status and expected response body to confirm successful authentication.
4. Secure Sensitive Data: Keep environment files with credentials out of public repositories.
5. Automate with Newman: Integrate tests into CI/CD pipelines for continuous verification.

Self Check

Where in this folder structure would you add a new environment file for testing Basic Authentication against a QA server?

Key Result

Organize Postman Basic Authentication tests using collections, environment variables, pre-request scripts, and integrate with CI/CD via Newman.

Practice

1. What does Basic Authentication in Postman primarily require to access a protected API?

easy

A. A username and password

B. An API key only

C. A token generated by OAuth

D. No credentials, just the URL

Solution

1. Step 1: Understand Basic Authentication

   Basic Authentication requires a username and password to verify identity.

2. Step 2: Identify Postman's method

   Postman uses these credentials to add an Authorization header automatically.

3. Final Answer:

   A username and password -> Option A

4. Quick Check:

   Basic Auth = username + password [OK]

Hint: Basic Auth always needs username and password [OK]

Common Mistakes:

• Confusing Basic Auth with API key or OAuth tokens
• Thinking no credentials are needed
• Using only username or only password

2. Which is the correct way to set Basic Authentication in Postman?

easy

A. Select 'Basic Auth' in the Authorization tab and enter credentials

B. Use the Body tab to send username and password

C. Put credentials in the URL query parameters

D. Add username and password in the Headers tab manually

Solution

1. Step 1: Locate Authorization tab in Postman

   Postman provides an Authorization tab to set authentication types easily.

2. Step 2: Choose Basic Auth and enter credentials

   Selecting Basic Auth lets you enter username and password which Postman encodes automatically.

3. Final Answer:

   Select 'Basic Auth' in the Authorization tab and enter credentials -> Option A

4. Quick Check:

   Use Authorization tab for Basic Auth [OK]

Hint: Use Authorization tab, not Headers or Body [OK]

Common Mistakes:

• Manually adding Authorization header incorrectly
• Putting credentials in URL which is insecure
• Sending credentials in request body for Basic Auth

3. What will Postman send in the Authorization header when you enter username 'user1' and password 'pass123' for Basic Auth?

medium

A. Authorization: Basic user1:pass123

B. Authorization: Bearer user1:pass123

C. Authorization: Basic dXNlcjE6cGFzczEyMw==

D. Authorization: Token dXNlcjE6cGFzczEyMw==

Solution

1. Step 1: Understand Basic Auth header format

   Basic Auth sends 'Authorization: Basic ' plus base64 encoding of 'username:password'.

2. Step 2: Encode 'user1:pass123' in base64

   Encoding 'user1:pass123' results in 'dXNlcjE6cGFzczEyMw=='.

3. Final Answer:

   Authorization: Basic dXNlcjE6cGFzczEyMw== -> Option C

4. Quick Check:

   Basic Auth header = 'Basic ' + base64(username:password) [OK]

Hint: Basic Auth header is 'Basic ' + base64(username:password) [OK]

Common Mistakes:

• Using 'Bearer' instead of 'Basic'
• Sending plain username:password without encoding
• Confusing token or API key formats

4. You set Basic Auth in Postman but get a 401 Unauthorized error. What is the most likely cause?

medium

A. Using HTTPS instead of HTTP

B. Incorrect username or password entered

C. Headers tab is empty

D. Request body is missing

Solution

1. Step 1: Understand 401 Unauthorized meaning

   401 means the server rejected the credentials provided.

2. Step 2: Check credentials correctness

   Most common cause is wrong username or password causing authentication failure.

3. Final Answer:

   Incorrect username or password entered -> Option B

4. Quick Check:

   401 error = bad credentials [OK]

Hint: 401 usually means wrong username or password [OK]

Common Mistakes:

• Thinking HTTPS causes 401 error
• Assuming missing body causes authentication failure
• Ignoring credential typos

5. You want to test an API with Basic Auth but keep your password secure. Which Postman feature helps you avoid exposing your password in the request headers?

hard

A. Write the password directly in the URL

B. Disable SSL verification

C. Send credentials in the request body as plain text

D. Use environment variables to store credentials and reference them

Solution

1. Step 1: Identify secure ways to handle credentials

   Storing credentials in environment variables keeps them hidden and reusable.

2. Step 2: Use variables in Authorization tab

   Referencing variables in Basic Auth fields avoids hardcoding sensitive info in requests.

3. Final Answer:

   Use environment variables to store credentials and reference them -> Option D

4. Quick Check:

   Environment variables protect sensitive data [OK]

Hint: Use environment variables for credentials security [OK]

Common Mistakes:

• Putting password in URL exposes it
• Sending password in body is insecure for Basic Auth
• Disabling SSL reduces security, not protects password