Basic authentication in Postman - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to set the Authorization header for Basic authentication in Postman.

Postman

pm.request.headers.add({ key: 'Authorization', value: 'Basic [1]' });

Drag options to blanks, or click blank then click option'

Abtoa('username:password')

Batob('username:password')

C'username:password'

DencodeURI('username:password')

Attempts:

3 left

💡 Hint

Common Mistakes

Using atob() which decodes base64 instead of encoding.

Passing the plain 'username:password' string without encoding.

Using URL encoding instead of base64 encoding.

The Basic authentication header requires the username and password to be base64 encoded. The btoa() function encodes a string to base64.

2fill in blank

medium

Complete the code to extract the username and password from the Authorization header in a Postman test script.

Postman

const encoded = pm.request.headers.get('Authorization').split(' ')[[1]];

Drag options to blanks, or click blank then click option'

A1

B2

C0

D-1

Attempts:

3 left

💡 Hint

Common Mistakes

Using index 0 which gives the word 'Basic' instead of the encoded string.

Using index 2 which is out of range.

Using -1 which is not valid in JavaScript split arrays.

The Authorization header value is in the format 'Basic base64string'. Splitting by space gives ['Basic', 'base64string'], so index 1 contains the encoded credentials.

3fill in blank

hard

Fix the error in decoding the Basic auth credentials in the Postman test script.

Postman

const decoded = [1](encoded);

Drag options to blanks, or click blank then click option'

AencodeURI

Batob

Cbtoa

DdecodeURI

Attempts:

3 left

💡 Hint

Common Mistakes

Using btoa() which encodes instead of decodes.

Using URI encoding functions which do not handle base64.

Trying to parse the encoded string directly without decoding.

To decode base64 encoded credentials, use atob(). Using btoa() or encoding functions will cause errors.

4fill in blank

hard

Fill both blanks to check if the Authorization header uses Basic authentication and extract the encoded credentials.

Postman

if (pm.request.headers.get('Authorization')?.startsWith([1])) {
  const encoded = pm.request.headers.get('Authorization').split(' ')[[2]];
}

Drag options to blanks, or click blank then click option'

A'Basic'

B'Bearer'

C0

D1

Attempts:

3 left

💡 Hint

Common Mistakes

Checking for 'Bearer' instead of 'Basic'.

Using index 0 which gives the word 'Basic' instead of the encoded string.

Not using optional chaining which can cause errors if header is missing.

The Authorization header for Basic auth starts with 'Basic'. Splitting by space, the encoded credentials are at index 1.

5fill in blank

hard

Fill all three blanks to decode Basic auth credentials and split them into username and password.

Postman

const encoded = pm.request.headers.get('Authorization').split(' ')[[1]];
const decoded = [2](encoded);
const [[3], password] = decoded.split(':');

Drag options to blanks, or click blank then click option'

A0

B1

Catob

Dusername

Attempts:

3 left

💡 Hint

Common Mistakes

Using index 0 which is the word 'Basic'.

Using btoa() instead of atob().

Not splitting the decoded string to get username and password.

Index 1 contains the encoded credentials. Use atob() to decode base64. Then split the decoded string by ':' to get username and password.

Practice

1. What does Basic Authentication in Postman primarily require to access a protected API?

easy

A. A username and password

B. An API key only

C. A token generated by OAuth

D. No credentials, just the URL

Solution

1. Step 1: Understand Basic Authentication

   Basic Authentication requires a username and password to verify identity.

2. Step 2: Identify Postman's method

   Postman uses these credentials to add an Authorization header automatically.

3. Final Answer:

   A username and password -> Option A

4. Quick Check:

   Basic Auth = username + password [OK]

Hint: Basic Auth always needs username and password [OK]

Common Mistakes:

• Confusing Basic Auth with API key or OAuth tokens
• Thinking no credentials are needed
• Using only username or only password

2. Which is the correct way to set Basic Authentication in Postman?

easy

A. Select 'Basic Auth' in the Authorization tab and enter credentials

B. Use the Body tab to send username and password

C. Put credentials in the URL query parameters

D. Add username and password in the Headers tab manually

Solution

1. Step 1: Locate Authorization tab in Postman

   Postman provides an Authorization tab to set authentication types easily.

2. Step 2: Choose Basic Auth and enter credentials

   Selecting Basic Auth lets you enter username and password which Postman encodes automatically.

3. Final Answer:

   Select 'Basic Auth' in the Authorization tab and enter credentials -> Option A

4. Quick Check:

   Use Authorization tab for Basic Auth [OK]

Hint: Use Authorization tab, not Headers or Body [OK]

Common Mistakes:

• Manually adding Authorization header incorrectly
• Putting credentials in URL which is insecure
• Sending credentials in request body for Basic Auth

3. What will Postman send in the Authorization header when you enter username 'user1' and password 'pass123' for Basic Auth?

medium

A. Authorization: Basic user1:pass123

B. Authorization: Bearer user1:pass123

C. Authorization: Basic dXNlcjE6cGFzczEyMw==

D. Authorization: Token dXNlcjE6cGFzczEyMw==

Solution

1. Step 1: Understand Basic Auth header format

   Basic Auth sends 'Authorization: Basic ' plus base64 encoding of 'username:password'.

2. Step 2: Encode 'user1:pass123' in base64

   Encoding 'user1:pass123' results in 'dXNlcjE6cGFzczEyMw=='.

3. Final Answer:

   Authorization: Basic dXNlcjE6cGFzczEyMw== -> Option C

4. Quick Check:

   Basic Auth header = 'Basic ' + base64(username:password) [OK]

Hint: Basic Auth header is 'Basic ' + base64(username:password) [OK]

Common Mistakes:

• Using 'Bearer' instead of 'Basic'
• Sending plain username:password without encoding
• Confusing token or API key formats

4. You set Basic Auth in Postman but get a 401 Unauthorized error. What is the most likely cause?

medium

A. Using HTTPS instead of HTTP

B. Incorrect username or password entered

C. Headers tab is empty

D. Request body is missing

Solution

1. Step 1: Understand 401 Unauthorized meaning

   401 means the server rejected the credentials provided.

2. Step 2: Check credentials correctness

   Most common cause is wrong username or password causing authentication failure.

3. Final Answer:

   Incorrect username or password entered -> Option B

4. Quick Check:

   401 error = bad credentials [OK]

Hint: 401 usually means wrong username or password [OK]

Common Mistakes:

• Thinking HTTPS causes 401 error
• Assuming missing body causes authentication failure
• Ignoring credential typos

5. You want to test an API with Basic Auth but keep your password secure. Which Postman feature helps you avoid exposing your password in the request headers?

hard

A. Write the password directly in the URL

B. Disable SSL verification

C. Send credentials in the request body as plain text

D. Use environment variables to store credentials and reference them

Solution

1. Step 1: Identify secure ways to handle credentials

   Storing credentials in environment variables keeps them hidden and reusable.

2. Step 2: Use variables in Authorization tab

   Referencing variables in Basic Auth fields avoids hardcoding sensitive info in requests.

3. Final Answer:

   Use environment variables to store credentials and reference them -> Option D

4. Quick Check:

   Environment variables protect sensitive data [OK]

Hint: Use environment variables for credentials security [OK]

Common Mistakes:

• Putting password in URL exposes it
• Sending password in body is insecure for Basic Auth
• Disabling SSL reduces security, not protects password