Testing Authenticated Endpoints with Swift and XCTest

Testing Authenticated Endpoints

Welcome to the final lesson of our journey through automated API testing with Swift. In this lesson, we'll focus on testing authenticated API endpoints using Swift's networking capabilities and the XCTest framework. Authentication is crucial for securing API endpoints against unauthorized access. By understanding how to test these mechanisms, you'll ensure that your API maintains its integrity and protects sensitive data. We'll explore practical examples for each authentication method — API Keys, Sessions, and JWT (JSON Web Tokens) — giving you the tools to verify that only authorized users can interact with protected resources.

API Key Authentication

API Key authentication is one of the simplest ways to secure an API. It involves sending a unique key as part of the request headers, allowing access to protected endpoints. Let's look at an example of how you can set up and test API Key authentication using Swift: Swiftimport XCTest import FoundationNetworking class TestAPIKeyAuthentication: XCTestCase { let baseURL = "http://localhost:8000" let apiKey = ProcessInfo.processInfo.environment["API_KEY"] ?? "" func testAPIKeyAuthentication() { // Arrange let url = URL(string: "\(self.baseURL)/todos")! let request = URLRequest(url: url) request.addValue(apiKey, forHTTPHeaderField: "X-API-Key") // Act let expectation = self.expectation(description: "API Key Authentication") let task = URLSession.shared.dataTask(with: request) { data, response, error in // Assert if let httpResponse = response as? HTTPURLResponse { XCTAssertEqual(httpResponse.statusCode, 200) } expectation.fulfill() } task.resume() waitForExpectations(timeout: 5, handler: nil) } } Here, we define a test class TestAPIKeyAuthentication. Within the test method, testAPIKeyAuthentication, we specify the headers, including the X-API-Key. We use URLSession to make a call to the /todos endpoint and pass the headers, ensuring the API key is included in the request. The test then asserts that the response status code is 200, indicating successful authentication and access to the endpoint.

Session Authentication: Setup

For session-based authentication, we establish a method for user credentials and a helper method for login. This enables each test to authenticate independently, providing a consistent environment to test both login functionality and access to protected endpoints: Swiftimport XCTest import FoundationNetworking class TestSessionAuthentication: XCTestCase { let baseURL = "http://localhost:8000" func authDetails() -> [String: String] { // Arrange - Providing user credentials from environment variables return [ "username": ProcessInfo.processInfo.environment["USERNAME"] ?? "", "password": ProcessInfo.processInfo.environment["PASSWORD"] ?? "" ] } // Helper method for sending a login POST request func login(session: URLSession, authDetails: [String: String], completion: @escaping (HTTPURLResponse?) -> Void) { let request = URLRequest(url: URL(string: "\(self.baseURL)/auth/login")!) request.httpMethod = "POST" request.httpBody = try? JSONSerialization.data(withJSONObject: authDetails, options: []) request.addValue("application/json", forHTTPHeaderField: "Content-Type") let task = session.dataTask(with: request) { data, response, error in completion(response as? HTTPURLResponse) } task.resume() } } The authDetails method supplies the required credentials, and the login helper method facilitates independent authentication for each test.

Join the 1M+ learners on CodeSignal

Be a part of our community of 1M+ users who develop and demonstrate their skills on CodeSignal

This test leverages the login helper method to authenticate independently, validating that user credentials create a session successfully:

Swift

func testLogin() {
    // Arrange - Initialize session
    let session = URLSession.shared

    // Act - Execute the login process using the helper method
    let expectation = self.expectation(description: "Login")
    login(session: session, authDetails: authDetails()) { response in
        // Assert - Verify that the login was successful
        XCTAssertEqual(response?.statusCode, 200)
        expectation.fulfill()
    }
    waitForExpectations(timeout: 5, handler: nil)
}

func testLogin() {
    // Arrange - Initialize session
    let session = URLSession.shared

    // Act - Execute the login process using the helper method
    let expectation = self.expectation(description: "Login")
    login(session: session, authDetails: authDetails()) { response in
        // Assert - Verify that the login was successful
        XCTAssertEqual(response?.statusCode, 200)
        expectation.fulfill()
    }
    waitForExpectations(timeout: 5, handler: nil)
}

The use of the helper ensures that this test does not rely on any previous operations, providing isolated verification of login success via status code.

In this test, we independently authenticate using the helper method before confirming that an established session grants access to a protected endpoint:

Swift

func testAccessWithSession() {
    // Arrange - Use the login helper method to authenticate
    let session = URLSession.shared
    let expectation = self.expectation(description: "Access with Session")

    login(session: session, authDetails: authDetails()) { response in
        guard response?.statusCode == 200 else {
            XCTFail("Login failed")
            expectation.fulfill()
            return
        }

        // Act - Request the protected resource using the session
        let request = URLRequest(url: URL(string: "\(self.baseURL)/todos")!)
        let task = session.dataTask(with: request) { data, response, error in
            // Assert - Confirm access is granted with a successful status code
            if let httpResponse = response as? HTTPURLResponse {
                XCTAssertEqual(httpResponse.statusCode, 200)
            }
            expectation.fulfill()
        }
        task.resume()
    }
    waitForExpectations(timeout: 5, handler: nil)
}

func testAccessWithSession() {
    // Arrange - Use the login helper method to authenticate
    let session = URLSession.shared
    let expectation = self.expectation(description: "Access with Session")

    login(session: session, authDetails: authDetails()) { response in
        guard response?.statusCode == 200 else {
            XCTFail("Login failed")
            expectation.fulfill()
            return
        }

        // Act - Request the protected resource using the session
        let request = URLRequest(url: URL(string: "\(self.baseURL)/todos")!)
        let task = session.dataTask(with: request) { data, response, error in
            // Assert - Confirm access is granted with a successful status code
            if let httpResponse = response as? HTTPURLResponse {
                XCTAssertEqual(httpResponse.statusCode, 200)
            }
            expectation.fulfill()
        }
        task.resume()
    }
    waitForExpectations(timeout: 5, handler: nil)
}

The helper method's strategic use ensures that each test individually verifies session-based access, unaffected by the results of prior tests.

By using the login helper method, this test independently authenticates and then verifies the ability to terminate a session, ensuring logout functionality is effective:

Swift

func testLogoutWithSession() {
    // Arrange - Use the login helper method to authenticate
    let session = URLSession.shared
    let expectation = self.expectation(description: "Logout with Session")

    login(session: session, authDetails: authDetails()) { response in
        guard response?.statusCode == 200 else {
            XCTFail("Login failed")
            expectation.fulfill()
            return
        }

        // Act - Perform a logout operation to terminate the session
        let request = URLRequest(url: URL(string: "\(self.baseURL)/auth/logout")!)
        request.httpMethod = "POST"
        let task = session.dataTask(with: request) { data, response, error in
            // Assert - Verify logout success via status code
            if let httpResponse = response as? HTTPURLResponse {
                XCTAssertEqual(httpResponse.statusCode, 200)
            }
            expectation.fulfill()
        }
        task.resume()
    }
    waitForExpectations(timeout: 5, handler: nil)
}

func testLogoutWithSession() {
    // Arrange - Use the login helper method to authenticate
    let session = URLSession.shared
    let expectation = self.expectation(description: "Logout with Session")

    login(session: session, authDetails: authDetails()) { response in
        guard response?.statusCode == 200 else {
            XCTFail("Login failed")
            expectation.fulfill()
            return
        }

        // Act - Perform a logout operation to terminate the session
        let request = URLRequest(url: URL(string: "\(self.baseURL)/auth/logout")!)
        request.httpMethod = "POST"
        let task = session.dataTask(with: request) { data, response, error in
            // Assert - Verify logout success via status code
            if let httpResponse = response as? HTTPURLResponse {
                XCTAssertEqual(httpResponse.statusCode, 200)
            }
            expectation.fulfill()
        }
        task.resume()
    }
    waitForExpectations(timeout: 5, handler: nil)
}

This approach confirms isolation, as each session is independently managed, ensuring logout integrity without relying on previous tests.

Unlike session-based authentication, where the server maintains session state, JWT authentication is stateless. The server does not store user session information; instead, all authentication details are embedded within the token itself.

For JWT-based authentication, we replicate this strategy with a method for credentials and a login helper method, enabling each test to independently obtain and manage JWTs:

Swift

import XCTest
import FoundationNetworking

class TestJWTAuthentication: XCTestCase {

    let baseURL = "http://localhost:8000"

    func authDetails() -> [String: String] {
        // Arrange - User credentials for JWT from environment variables
        return [
            "username": ProcessInfo.processInfo.environment["USERNAME"] ?? "",
            "password": ProcessInfo.processInfo.environment["PASSWORD"] ?? ""
        ]
    }

    // Helper method for sending a login POST request
    func login(authDetails: [String: String], completion: @escaping (HTTPURLResponse?, [String: Any]?) -> Void) {
        let request = URLRequest(url: URL(string: "\(self.baseURL)/auth/login")!)
        request.httpMethod = "POST"
        request.httpBody = try? JSONSerialization.data(withJSONObject: authDetails, options: [])
        request.addValue("application/json", forHTTPHeaderField: "Content-Type")

        let task = URLSession.shared.dataTask(with: request) { data, response, error in
            let json = try? JSONSerialization.jsonObject(with: data ?? Data(), options: []) as? [String: Any]
            completion(response as? HTTPURLResponse, json)
        }
        task.resume()
    }
}

import XCTest
import FoundationNetworking

class TestJWTAuthentication: XCTestCase {

    let baseURL = "http://localhost:8000"

    func authDetails() -> [String: String] {
        // Arrange - User credentials for JWT from environment variables
        return [
            "username": ProcessInfo.processInfo.environment["USERNAME"] ?? "",
            "password": ProcessInfo.processInfo.environment["PASSWORD"] ?? ""
        ]
    }

    // Helper method for sending a login POST request
    func login(authDetails: [String: String], completion: @escaping (HTTPURLResponse?, [String: Any]?) -> Void) {
        let request = URLRequest(url: URL(string: "\(self.baseURL)/auth/login")!)
        request.httpMethod = "POST"
        request.httpBody = try? JSONSerialization.data(withJSONObject: authDetails, options: [])
        request.addValue("application/json", forHTTPHeaderField: "Content-Type")

        let task = URLSession.shared.dataTask(with: request) { data, response, error in
            let json = try? JSONSerialization.jsonObject(with: data ?? Data(), options: []) as? [String: Any]
            completion(response as? HTTPURLResponse, json)
        }
        task.resume()
    }
}

This setup empowers each test to authenticate independently, retrieving tokens without relying on the order or success of other tests.

Using the login helper method, this test independently verifies that successful authentication results in token issuance, forming the basis for accessing protected resources:

Swift

func testLogin() {
    // Act - Authenticate and retrieve JWT tokens
    let expectation = self.expectation(description: "JWT Login")
    login(authDetails: authDetails()) { response, json in
        // Assert - Confirm receipt of tokens and check their existence
        XCTAssertEqual(response?.statusCode, 200)
        XCTAssertNotNil(json?["access_token"])
        XCTAssertNotNil(json?["refresh_token"])
        expectation.fulfill()
    }
    waitForExpectations(timeout: 5, handler: nil)
}

func testLogin() {
    // Act - Authenticate and retrieve JWT tokens
    let expectation = self.expectation(description: "JWT Login")
    login(authDetails: authDetails()) { response, json in
        // Assert - Confirm receipt of tokens and check their existence
        XCTAssertEqual(response?.statusCode, 200)
        XCTAssertNotNil(json?["access_token"])
        XCTAssertNotNil(json?["refresh_token"])
        expectation.fulfill()
    }
    waitForExpectations(timeout: 5, handler: nil)
}

By independently logging in, the test ensures token validity regardless of prior tests, establishing the foundation for secure access.

This test independently authenticates using the helper method and verifies that a JWT access token provides entry to a protected endpoint:

Swift

func testAccessWithJWT() {
    // Arrange - Authenticate and obtain an access token using the helper method
    let expectation = self.expectation(description: "Access with JWT")
    login(authDetails: authDetails()) { response, json in
        guard let accessToken = json?["access_token"] as? String else {
            XCTFail("Failed to obtain access token")
            expectation.fulfill()
            return
        }

        // Act - Use the access token to request a protected endpoint
        let request = URLRequest(url: URL(string: "\(self.baseURL)/todos")!)
        request.addValue("Bearer \(accessToken)", forHTTPHeaderField: "Authorization")
        let task = URLSession.shared.dataTask(with: request) { data, response, error in
            // Assert - Confirm the request was successful by checking the status code
            if let httpResponse = response as? HTTPURLResponse {
                XCTAssertEqual(httpResponse.statusCode, 200)
            }
            expectation.fulfill()
        }
        task.resume()
    }
    waitForExpectations(timeout: 5, handler: nil)
}

func testAccessWithJWT() {
    // Arrange - Authenticate and obtain an access token using the helper method
    let expectation = self.expectation(description: "Access with JWT")
    login(authDetails: authDetails()) { response, json in
        guard let accessToken = json?["access_token"] as? String else {
            XCTFail("Failed to obtain access token")
            expectation.fulfill()
            return
        }

        // Act - Use the access token to request a protected endpoint
        let request = URLRequest(url: URL(string: "\(self.baseURL)/todos")!)
        request.addValue("Bearer \(accessToken)", forHTTPHeaderField: "Authorization")
        let task = URLSession.shared.dataTask(with: request) { data, response, error in
            // Assert - Confirm the request was successful by checking the status code
            if let httpResponse = response as? HTTPURLResponse {
                XCTAssertEqual(httpResponse.statusCode, 200)
            }
            expectation.fulfill()
        }
        task.resume()
    }
    waitForExpectations(timeout: 5, handler: nil)
}

By ensuring the test is independent, this approach validates the token's effectiveness in protecting resources, confirming stateless authentication.

Finally, this test independently authenticates to verify that access and refresh tokens can be invalidated, securing the system against unauthorized reuse:

Swift

func testJWTLogout() {
    // Arrange - Authenticate and prepare tokens using the helper method
    let expectation = self.expectation(description: "JWT Logout")
    login(authDetails: authDetails()) { response, json in
        guard let accessToken = json?["access_token"] as? String,
              let refreshToken = json?["refresh_token"] as? String else {
            XCTFail("Failed to obtain tokens")
            expectation.fulfill()
            return
        }

        let request = URLRequest(url: URL(string: "\(self.baseURL)/auth/logout")!)
        request.httpMethod = "POST"
        request.addValue("Bearer \(accessToken)", forHTTPHeaderField: "Authorization")
        request.httpBody = try? JSONSerialization.data(withJSONObject: ["refresh_token": refreshToken], options: [])
        request.addValue("application/json", forHTTPHeaderField: "Content-Type")

        // Act - Use access and refresh tokens to process logout
        let task = URLSession.shared.dataTask(with: request) { data, response, error in
            // Assert - Verify logout success through confirmation of status code
            if let httpResponse = response as? HTTPURLResponse {
                XCTAssertEqual(httpResponse.statusCode, 200)
            }
            expectation.fulfill()
        }
        task.resume()
    }
    waitForExpectations(timeout: 5, handler: nil)
}

func testJWTLogout() {
    // Arrange - Authenticate and prepare tokens using the helper method
    let expectation = self.expectation(description: "JWT Logout")
    login(authDetails: authDetails()) { response, json in
        guard let accessToken = json?["access_token"] as? String,
              let refreshToken = json?["refresh_token"] as? String else {
            XCTFail("Failed to obtain tokens")
            expectation.fulfill()
            return
        }

        let request = URLRequest(url: URL(string: "\(self.baseURL)/auth/logout")!)
        request.httpMethod = "POST"
        request.addValue("Bearer \(accessToken)", forHTTPHeaderField: "Authorization")
        request.httpBody = try? JSONSerialization.data(withJSONObject: ["refresh_token": refreshToken], options: [])
        request.addValue("application/json", forHTTPHeaderField: "Content-Type")

        // Act - Use access and refresh tokens to process logout
        let task = URLSession.shared.dataTask(with: request) { data, response, error in
            // Assert - Verify logout success through confirmation of status code
            if let httpResponse = response as? HTTPURLResponse {
                XCTAssertEqual(httpResponse.statusCode, 200)
            }
            expectation.fulfill()
        }
        task.resume()
    }
    waitForExpectations(timeout: 5, handler: nil)
}

This test confirms the secure handling and invalidation of tokens, ensuring each test independently checks the integrity of the logout process.

Throughout this lesson, we've explored different methods of API authentication: API Keys, Sessions, and JWTs. Each method has distinct ways to test and secure access, and you've seen how to implement tests for them effectively using Swift and XCTest.

When testing any form of authentication, it’s crucial to handle API credentials with care. Avoid hardcoding sensitive information in your codebase, and consider using environment variables or secure vaults in production environments.

As we conclude this lesson and the course, take pride in the journey you've completed. You've gained a comprehensive understanding of how to automate API tests using Swift, mastering basic requests through to secure, authenticated endpoints. Continue to practice and explore, applying these skills to ensure robust, reliable APIs in your projects. Congratulations on reaching the end of this course!