Basic authentication in Rest API - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Predict Output

intermediate

What is the output of this Basic Authentication header decoding?

Given the HTTP header Authorization: Basic QWxhZGRpbjpPcGVuU2VzYW1l, what is the decoded username and password?

Rest API

import base64
header = 'Basic QWxhZGRpbjpPcGVuU2VzYW1l'
encoded = header.split()[1]
decoded = base64.b64decode(encoded).decode('utf-8')
print(decoded)

A "QWxhZGRpbjpPcGVuU2VzYW1l"

B "Aladdin-OpenSesame"

C "Aladdin:OpenSesame"

D "Basic QWxhZGRpbjpPcGVuU2VzYW1l"

💡 Hint

Remember Basic Authentication encodes username and password as base64 of 'username:password'.

The string after 'Basic' is base64 encoded. Decoding it reveals the username and password separated by a colon.

🧠 Conceptual

intermediate

What error occurs if the Basic Authentication header is missing?

If a REST API endpoint requires Basic Authentication but the client sends no Authorization header, what HTTP status code should the server respond with?

A 401 Unauthorized

B 403 Forbidden

C 400 Bad Request

D 404 Not Found

💡 Hint

Think about what status code means 'authentication required'.

401 Unauthorized means the client must authenticate to get the requested response.

🔧 Debug

advanced

Why does this Basic Authentication code fail to authenticate?

This Python code snippet is intended to check Basic Authentication but always fails. Why?

auth_header = request.headers.get('Authorization')
if auth_header:
    encoded = auth_header.split(' ')[1]
    decoded = base64.b64decode(encoded).decode('utf-8')
    username, password = decoded.split(':')
    if username == 'admin' and password == '1234':
        return 'Access granted'
return 'Access denied'

Rest API

auth_header = request.headers.get('Authorization')
if auth_header:
    encoded = auth_header.split(' ')[1]
    decoded = base64.b64decode(encoded).decode('utf-8')
    username, password = decoded.split(':')
    if username == 'admin' and password == '1234':
        return 'Access granted'
return 'Access denied'

A The code uses 'Authorization' header but should use 'Authentication' header.

B The base64 decoding is done incorrectly; it should decode to bytes, not string.

C The split(':') fails because the decoded string uses a comma instead of colon.

D The code does not handle missing or malformed Authorization header properly, causing exceptions.

💡 Hint

Consider what happens if the header is missing or malformed.

If the Authorization header is missing or does not contain a space, split(' ')[1] will cause an IndexError. The code lacks error handling for these cases.

📝 Syntax

advanced

Which option correctly forms a Basic Authentication header in Python?

You want to create a Basic Authentication header for username 'user' and password 'pass'. Which code snippet correctly creates the header string?

A

import base64
credentials = 'user:pass'
header = 'Basic ' + base64.encode(credentials)

B

import base64
credentials = 'user:pass'
header = 'Basic ' + base64.b64encode(credentials.encode()).decode()

C

import base64
credentials = 'user:pass'
header = 'Basic ' + base64.b64decode(credentials.encode()).decode()

D

import base64
credentials = 'user:pass'
header = 'Basic ' + base64.b64encode(credentials)

💡 Hint

Remember to encode string to bytes before base64 encoding, then decode back to string.

Option B correctly encodes the credentials string to bytes, base64 encodes it, then decodes back to string to form the header.

🚀 Application

expert

How many valid username-password pairs can be extracted from this Basic Authentication header?

Given the HTTP header Authorization: Basic dXNlcjE6cGFzczEsdXNlcjI6cGFzczI=, how many valid username-password pairs does it contain when decoded?

A 1

B 2

C 0

D 3

💡 Hint

Basic Authentication encodes a single 'username:password' pair, not multiple pairs separated by commas.

The base64 string decodes to 'user1:pass1,user2:pass2' which is a single string, not two separate pairs. Basic Auth expects one pair only.