Testing Authenticated API Endpoints with JavaScript

Welcome to the final lesson in our journey through automated API testing with JavaScript. In this lesson, we'll focus on testing authenticated API endpoints using JavaScript tools like fetch for making HTTP requests and jest for writing and running tests. Authentication is essential for securing API endpoints against unauthorized access. By understanding how to test these mechanisms, you'll ensure that your API maintains its integrity and protects sensitive data. We'll explore practical examples for each authentication method — API Keys, Sessions, and JWT (JSON Web Tokens) — giving you the tools to verify that only authorized users can interact with protected resources.

API Key authentication is one of the simplest ways to secure an API. It involves sending a unique key as part of the request headers, allowing access to protected endpoints. Let's look at an example of how you can set up and test API Key authentication using JavaScript:

const fetch = require('node-fetch');

const BASE_URL = "http://localhost:8000";
const API_KEY = "123e4567-e89b-12d3-a456-426614174000";

test('API Key Authentication', async () => {
    // Arrange
    const headers = { "X-API-Key": API_KEY };
    
    // Act
    const response = await fetch(`${BASE_URL}/todos`, { headers });

    // Assert
    expect(response.status).toBe(200);
});

Here, we define a test using jest. We specify the headers, including the X-API-Key, and use the fetch function to make a call to the /todos endpoint, ensuring the API key is included in the request. The test then asserts that the response status code is 200, indicating successful authentication and access to the endpoint.

We begin our session-based authentication by establishing a fixture for user credentials and a helper function for login. This enables each test to authenticate independently, providing a consistent environment to test both login functionality and access to protected endpoints:

const fetch = require('node-fetch');

const BASE_URL = "http://localhost:8000";

const authDetails = {
    username: "testuser",
    password: "testpass123"
};

// Helper function for sending a login POST request
async function login(authDetails) {
    // Sends a login request and maintains session state
    const response = await fetch(`${BASE_URL}/auth/login`, {
        method: 'POST',
        headers: { 'Content-Type': 'application/json' },
        body: JSON.stringify(authDetails)
    });
    return response;
}

The authDetails object supplies the required credentials, and the login helper function facilitates independent authentication for each test.