API Testing : Check authorization handling

Verify that the API correctly handles authorization based on user roles or permissions.

Language: Java

Framework: Rest assured

copy
1import io.restassured.RestAssured;2import io.restassured.response.Response;3import org.testng.Assert;4import org.testng.annotations.Test;56public class APIAuthorizationTest {78 @Test9 public void testAuthorizationHandling() {10 /​/​Assuming the API is hosted on localhost with port 8080 and /​api/​auth endpoint11 RestAssured.baseURI = "http:/​/​localhost:8080";12 Response response = RestAssured.given().auth().preemptive().basic("admin", "password").when().get("/​api/​auth");13 int statusCode = response.getStatusCode();14 Assert.assertEquals(statusCode, 200, "Authorization handling failed");1516 /​/​Add commented code to connect to remote client with desired capabilities17 /​*DesiredCapabilities dc = new DesiredCapabilities();18 dc.setCapability("platformName", "Android");19 dc.setCapability("deviceName", "emulator-5554");20 dc.setCapability("appPackage", "com.example.testapp");21 dc.setCapability("appActivity", ".MainActivity");22 dc.setCapability("automationName", "UiAutomator2");23 RemoteWebDriver driver = new RemoteWebDriver(new URL("http:/​/​127.0.0.1:4723/​wd/​hub"), dc);*/​24 }25}

Language: Javascript

copy
1/​/​ Mocha with Chai.23/​/​Assumptions: 4/​/​1. The API has different user roles (e.g. Admin, User) that determine their level of authorization to access certain features/​functions.5/​/​2. The API requires a valid access token for authentication and authorization purposes.6/​/​3. The API returns a 401 Unauthorized error message when an unauthorized user attempts to access a feature/​function that requires higher authorization.7/​/​4. The API returns a 200 OK response message when an authorized user attempts to access a feature/​function that requires lower authorization.89describe('Authorization handling', function() {10 11 it('should allow Admin users to access all features/​functions', function(done) {12 /​/​code to authenticate Admin user and retrieve access token13 /​/​code to make a request to an endpoint that requires Admin authorization and verify that a 200 OK response is returned14 done();15 });1617 it('should allow User users to access features/​functions with lower authorization', function(done) {18 /​/​code to authenticate User user and retrieve access token19 /​/​code to make a request to an endpoint that requires User authorization and verify that a 200 OK response is returned20 /​/​code to make a request to an endpoint that requires Admin authorization and verify that a 401 Unauthorized error message is returned21 done();22 });2324 it('should not allow unauthorized users to access features/​functions with higher authorization', function(done) {25 /​/​code to make a request to an endpoint that requires Admin authorization without authentication26 /​/​code to make a request to an endpoint that requires User authorization with invalid access token27 /​/​code to verify that a 401 Unauthorized error message is returned for both requests28 done();29 });30 31});3233/​/​To run the test on a remote client with desired capabilities, add the following code:3435const { Builder } = require("selenium-webdriver");36const selenium = require("selenium-webdriver");37const Capabilities = selenium.Capabilities;3839const chromeCapabilities = Capabilities.chrome();40chromeCapabilities.set("version", "latest");41chromeCapabilities.set("platform", "Windows 10");4243const driver = new Builder()44 .usingServer("http:/​/​remoteclient:4444/​wd/​hub")45 .withCapabilities(chromeCapabilities)46 .build();4748describe('Authorization handling', function() {49 before(async function() {50 await driver.get('http:/​/​apiwebsite.com');51 });52 53 it('should allow Admin users to access all features/​functions', async function() {54 /​/​code to authenticate Admin user and retrieve access token55 /​/​code to make a request to an endpoint that requires Admin authorization and verify that a 200 OK response is returned56 });5758 it('should allow User users to access features/​functions with lower authorization', async function() {59 /​/​code to authenticate User user and retrieve access token60 /​/​code to make a request to an endpoint that requires User authorization and verify that a 200 OK response is returned61 /​/​code to make a request to an endpoint that requires Admin authorization and verify that a 401 Unauthorized error message is returned62 });6364 it('should not allow unauthorized users to access features/​functions with higher authorization', async function() {65 /​/​code to make a request to an endpoint that requires Admin authorization without authentication66 /​/​code to make a request to an endpoint that requires User authorization with invalid access token67 /​/​code to verify that a 401 Unauthorized error message is returned for both requests68 });69 70 after(async function() {71 await driver.quit();72 });73});

Disclaimer: Following code snippets and related information have been sourced from GitHub and/or generated using AI code generation tools. LambdaTest takes no responsibility in the accuracy of the code and is not liable for any damages.

Accelerate Your Automation Test Cycles With LambdaTest

Leverage LambdaTest’s cloud-based platform to execute your automation tests in parallel and trim down your test execution time significantly. Your first 100 automation testing minutes are on us.

Try LambdaTest

Power Your Software Testing with AI and cloud

Test Intelligently and ship faster. Deliver unparalleled digital experiences for real world enterprises.

Start Free Testing