Testing Authenticated API Endpoints with Dart

Testing Authenticated Endpoints

Welcome to the final chapter of our journey through automated API testing with Dart. In this lesson, we'll focus on testing authenticated API endpoints . While you've already learned to organize tests and handle CRUD operations using Dart's test package, today we'll delve into how APIs manage secure access through different authentication methods — API Keys, Sessions, and JWT (JSON Web Tokens) . Authentication is crucial for securing API endpoints against unauthorized access. By understanding how to test these mechanisms, you'll ensure that your API maintains its integrity and protects sensitive data. We'll explore practical examples for each authentication method, giving you the tools to verify that only authorized users can interact with protected resources.

API Key Authentication

API Key authentication is one of the simplest ways to secure an API. It involves sending a unique key as part of the request headers, allowing access to protected endpoints. Let's look at an example of how you can set up and test API Key authentication using Dart: Dart import 'package:http/http.dart' as http; import 'package:test/test.dart'; void main() {final String baseUrl = "http://localhost:8000"; final String apiKey = "123e4567-e89b-12d3-a456-426614174000"; test('API Key authentication', () async {// Arrange final headers = {"X-API-Key": apiKey}; // Act final response = await http.get(Uri.parse('$baseUrl/todos'), headers: headers); // Assert expect(response.statusCode, equals(200));});} Here, we define a test using Dart's test package. Within the test, we specify the headers, including the X-API-Key . We use the http.get method to make a call to the /todos endpoint and pass the headers, ensuring the API key is included in the request. The test then asserts that the response status code is 200, indicating successful authentication and access to the endpoint.

Session Authentication: Setup

To facilitate session-based authentication, we create a login helper function. This function is responsible for sending a POST request to the login endpoint with user credentials and extracting the session ID from the response headers. This allows each test to authenticate independently, ensuring that tests do not interfere with each other and providing a consistent environment for verifying both login functionality and access to protected endpoints: Dart import 'dart:convert'; import 'package:http/http.dart' as http; import 'package:test/test.dart'; void main() {final String baseUrl = "http://localhost:8000"; final authDetails = {"username": "testuser", "password": "testpass123"}; Future<String> login(Map<String, String> credentials) async {final response = await http.post(Uri.parse('$baseUrl/auth/login'), headers: {"Content-Type": "application/json"}, body: jsonEncode(credentials),); if (response.statusCode != 200) {throw Exception("Login failed");} // Extract the session ID from the 'set-cookie' header final sessionId = response.headers['set-cookie']; return sessionId ?? "";} This function is designed to be reusable across multiple tests, ensuring that each test can independently authenticate and manage session IDs without relying on the results of previous tests.

Join the 1M+ learners on CodeSignal

Be a part of our community of 1M+ users who develop and demonstrate their skills on CodeSignal

In this test, we utilize the login function to authenticate independently, verifying that user credentials successfully create a session and extract the session ID:

Dart

test('Session Login', () async {
  // Arrange & Act
  final sessionId = await login(authDetails);

  // Assert
  expect(sessionId, isNotEmpty);
});

test('Session Login', () async {
  // Arrange & Act
  final sessionId = await login(authDetails);

  // Assert
  expect(sessionId, isNotEmpty);
});

By using the login function, this test ensures isolated verification of login success, confirming that the session is established correctly and the session ID is extracted.

In this test, we independently authenticate using the login function, extract the session ID, and confirm that an established session grants access to a protected endpoint:

Dart

test('Session Protected Route', () async {
  // Arrange
  final sessionId = await login(authDetails);

  // Act
  final headers = {"Cookie": sessionId};
  final response = await http.get(Uri.parse('$baseUrl/todos'), headers: headers);

  // Assert
  expect(response.statusCode, equals(200));
});

test('Session Protected Route', () async {
  // Arrange
  final sessionId = await login(authDetails);

  // Act
  final headers = {"Cookie": sessionId};
  final response = await http.get(Uri.parse('$baseUrl/todos'), headers: headers);

  // Assert
  expect(response.statusCode, equals(200));
});

The login function's strategic use ensures that each test individually verifies session-based access, unaffected by the results of prior tests.

By using the login function, this test independently authenticates, extracts the session ID, and then verifies the ability to terminate a session, ensuring logout functionality is effective:

Dart

test('Session Logout', () async {
  // Arrange
  final sessionId = await login(authDetails);

  // Act
  final headers = {"Cookie": sessionId};
  final logoutResponse = await http.post(Uri.parse('$baseUrl/auth/logout'), headers: headers);
  
  // Assert
  expect(logoutResponse.statusCode, equals(200));
});

test('Session Logout', () async {
  // Arrange
  final sessionId = await login(authDetails);

  // Act
  final headers = {"Cookie": sessionId};
  final logoutResponse = await http.post(Uri.parse('$baseUrl/auth/logout'), headers: headers);
  
  // Assert
  expect(logoutResponse.statusCode, equals(200));
});

This approach confirms isolation, as each session is independently managed, ensuring logout integrity without relying on previous tests.

For JWT-based authentication, we create a jwtLogin helper function. This function sends a POST request to the login endpoint with user credentials and retrieves the JWT tokens. This setup allows each test to independently obtain and manage JWTs, ensuring that tests are not dependent on the order or success of other tests:

Dart

import 'dart:convert';
import 'package:http/http.dart' as http;
import 'package:test/test.dart';

void main() {
  final String baseUrl = "http://localhost:8000";
  final authDetails = {
    "username": "testuser",
    "password": "testpass123"
  };

  Future<Map<String, dynamic>> jwtLogin(Map<String, String> credentials) async {
    final response = await http.post(
      Uri.parse('$baseUrl/auth/login'),
      headers: {"Content-Type": "application/json"},
      body: jsonEncode(credentials),
    );
    if (response.statusCode != 200) {
      throw Exception("Login failed");
    }
    return jsonDecode(response.body);
  }

import 'dart:convert';
import 'package:http/http.dart' as http;
import 'package:test/test.dart';

void main() {
  final String baseUrl = "http://localhost:8000";
  final authDetails = {
    "username": "testuser",
    "password": "testpass123"
  };

  Future<Map<String, dynamic>> jwtLogin(Map<String, String> credentials) async {
    final response = await http.post(
      Uri.parse('$baseUrl/auth/login'),
      headers: {"Content-Type": "application/json"},
      body: jsonEncode(credentials),
    );
    if (response.statusCode != 200) {
      throw Exception("Login failed");
    }
    return jsonDecode(response.body);
  }

The jwtLogin function is crafted to be reusable, allowing each test to independently authenticate and retrieve tokens.

Using the jwtLogin function, this test independently verifies that successful authentication results in token issuance, forming the basis for accessing protected resources:

Dart

test('JWT Login', () async {
  // Act
  final tokens = await jwtLogin(authDetails);

  // Assert
  final accessToken = tokens['access_token'];
  expect(accessToken, isNotNull);
  final refreshToken = tokens['refresh_token'];
  expect(refreshToken, isNotNull);
});

test('JWT Login', () async {
  // Act
  final tokens = await jwtLogin(authDetails);

  // Assert
  final accessToken = tokens['access_token'];
  expect(accessToken, isNotNull);
  final refreshToken = tokens['refresh_token'];
  expect(refreshToken, isNotNull);
});

By independently logging in, the test ensures token validity, establishing the foundation for secure access to protected endpoints.

This test independently authenticates using the jwtLogin function and verifies that a JWT access token provides entry to a protected endpoint:

Dart

test('JWT Protected Route', () async {
  // Act
  final tokens = await jwtLogin(authDetails);
  final accessToken = tokens['access_token'];

  // Access a protected endpoint
  final headers = {"Authorization": "Bearer $accessToken"};
  final response = await http.get(Uri.parse('$baseUrl/todos'), headers: headers);

  // Assert
  expect(response.statusCode, equals(200));
});

test('JWT Protected Route', () async {
  // Act
  final tokens = await jwtLogin(authDetails);
  final accessToken = tokens['access_token'];

  // Access a protected endpoint
  final headers = {"Authorization": "Bearer $accessToken"};
  final response = await http.get(Uri.parse('$baseUrl/todos'), headers: headers);

  // Assert
  expect(response.statusCode, equals(200));
});

By ensuring the test is independent, this approach validates the token's effectiveness in protecting resources, confirming stateless authentication.

Finally, this test independently authenticates to verify that access and refresh tokens can be invalidated, securing the system against unauthorized reuse:

Dart

test('JWT Logout', () async {
  // Act
  final tokens = await jwtLogin(authDetails);
  final accessToken = tokens['access_token'];
  final refreshToken = tokens['refresh_token'];

  final headers = {
    "Authorization": "Bearer $accessToken",
    "Content-Type": "application/json"
  };

  // Logout
  final logoutResponse = await http.post(
    Uri.parse('$baseUrl/auth/logout'),
    headers: headers,
    body: jsonEncode({"refresh_token": refreshToken}),
  );

  // Assert
  expect(logoutResponse.statusCode, equals(200));
});

test('JWT Logout', () async {
  // Act
  final tokens = await jwtLogin(authDetails);
  final accessToken = tokens['access_token'];
  final refreshToken = tokens['refresh_token'];

  final headers = {
    "Authorization": "Bearer $accessToken",
    "Content-Type": "application/json"
  };

  // Logout
  final logoutResponse = await http.post(
    Uri.parse('$baseUrl/auth/logout'),
    headers: headers,
    body: jsonEncode({"refresh_token": refreshToken}),
  );

  // Assert
  expect(logoutResponse.statusCode, equals(200));
});

This test confirms the secure handling and invalidation of tokens, ensuring each test independently checks the integrity of the logout process.

Throughout this lesson, we've explored different methods of API authentication: API Keys, Sessions, and JWTs. Each method has distinct ways to test and secure access, and you've seen how to implement tests for them effectively using Dart.

When testing any form of authentication, it’s crucial to handle API credentials with care. Avoid hardcoding sensitive information in your codebase, and consider using environment variables or secure vaults in production environments.

As we conclude this lesson and the course, take pride in the journey you've completed. You've gained a comprehensive understanding of how to automate API tests using Dart, mastering basic requests through to secure, authenticated endpoints. Continue to practice and explore, applying these skills to ensure robust, reliable APIs in your projects. Congratulations on reaching the end of this course!

Testing Authenticated Endpoints

API Key Authentication

Session Authentication: Setup

Join the 1M+ learners on CodeSignal

Session Authentication: Testing Login

Session Authentication: Testing Protected Endpoint

Session Authentication: Testing Logout

JWT Authentication: Setup

JWT Authentication: Testing Login

JWT Authentication: Testing Protected Endpoint

JWT Authentication: Testing Logout

Summary and Practices