30 / 65 · 14 API Testing Fundamentals · Authentication Testing← prev⊞ allnext →☰ Read as one page
4.6Practical Exercise
- Write tests for a login flow: valid credentials, invalid password, invalid email, empty fields
- Test JWT lifecycle: obtain token, use it, let it expire, verify 401, refresh it
- Test RBAC: create fixtures for admin, editor, and viewer roles; verify access matrix
- Test for IDOR: verify User A cannot access User B's data
- Test for information leakage: verify error messages do not reveal user existence