Why auth testing secures APIs in Postman - Challenge Your Understanding

Challenge - 5 Problems

🧠 Conceptual

intermediate

Why is authentication testing important for API security?

Authentication testing ensures that only valid users can access the API. What is the main reason this protects the API?

A It speeds up the API response time by caching user data.

B It prevents unauthorized users from accessing sensitive data or functions.

C It automatically fixes bugs in the API code.

D It allows anyone to use the API without restrictions.

💡 Hint

Think about what happens if someone who shouldn't access the API tries to do so.

Authentication testing confirms that only users with valid credentials can use the API, protecting sensitive information and operations from unauthorized access.

❓ Predict Output

intermediate

What is the result of this Postman test script?

Given this Postman test script that checks for a valid token in the response header, what will be the test result?

Postman

pm.test('Token is present', function () {
    pm.response.to.have.header('Authorization');
});

A Test passes if the response includes an 'Authorization' header.

B Test passes only if the response body contains the word 'token'.

C Test fails if the response includes an 'Authorization' header.

D Test fails if the response status code is 200.

💡 Hint

Look at what the test is checking in the response.

The test checks if the response headers include 'Authorization'. If yes, the test passes.

❓ assertion

advanced

Which assertion correctly verifies a 401 Unauthorized status in Postman?

You want to confirm that an API returns a 401 status code when authentication fails. Which assertion is correct?

A pm.test('Status is 401', () => pm.response.to.have.status(401));

B pm.test('Status is 401', () => pm.response.status === 401);

C pm.test('Status is 401', () => pm.response.statusCode === '401');

D pm.test('Status is 401', () => pm.response.statusCode == 401);

💡 Hint

Check the Postman syntax for status code assertions.

Option A uses the correct Postman assertion method to check the status code.

🔧 Debug

advanced

Why does this Postman test fail to detect missing token?

Consider this test script meant to check if the 'Authorization' header is missing. Why does it fail even when the header is absent?

Postman

pm.test('Authorization header missing', function () {
    pm.expect(pm.response.headers.get('Authorization')).to.not.be.null;
});

A The test should check for undefined instead of null.

B The method headers.get() is incorrect and causes an error.

C The test expects the header to NOT be null, so it fails when header is missing.

D The test is missing a semicolon causing a syntax error.

💡 Hint

Look carefully at what the test expects about the header's presence.

The test expects the header to exist (not null), so it fails when the header is missing, which is the opposite of the intended check.

❓ framework

expert

Which Postman test script correctly validates a JWT token format in the response header?

You want to verify that the 'Authorization' header contains a JWT token with three parts separated by dots. Which script correctly tests this?

A

pm.test('JWT token format', () => {
  const token = pm.response.headers.get('Authorization');
  pm.expect(token.split('.').length).to.eql(2);
});

B

pm.test('JWT token format', () => {
  const token = pm.response.headers.get('Authorization');
  pm.expect(token.includes('.')).to.be.true;
});

C

pm.test('JWT token format', () => {
  const token = pm.response.headers.get('Authorization');
  pm.expect(token.length).to.be.above(10);
});

D

pm.test('JWT token format', () => {
  const token = pm.response.headers.get('Authorization');
  pm.expect(token.split('.').length).to.eql(3);
});

💡 Hint

JWT tokens have three parts separated by two dots.

JWT tokens have three parts separated by dots, so splitting by '.' should give length 3.