Skip to main content

Module 6 · API testing

Authentication and request validation

Test who may call an API and what it must reject.

About 10 min reading and 10 min practice (estimates)

Loading progress…

Read

Learning objectives

  • Tell authentication from authorisation, and 401 from 403.
  • Design negative tests for invalid input.
  • Check that one user can't read or change another user's data.

Explanation

  • Authentication asks who you are — usually a session cookie or a bearer token in the Authorization header. Missing or invalid credentials → 401.
  • Authorisation asks what you may do. Known user, but not allowed → 403. Many APIs return 404 instead, to avoid revealing that someone else's resource exists.
  • Validation: the server must check every field — required, type, length, range, format — and reply with a clear 4xx (often 400 or 422) without changing anything.

Cross-account access deserves its own tests: sign in as user A, then try to read or change user B's order by changing the id in the URL. This class of bug (often called IDOR) is common and serious. Only test this on systems you are authorised to test.

Example: negative tests for creating an order

RequestExpected
No Authorization header401, no order created
Valid token, quantity "two" (a string)400/422 naming the field
Quantity 11 (maximum is 10)400/422; nothing stored
Missing required "address"400/422 naming the field
User A's token, GET /v1/orders/{id of user B}403 or 404; no data from B
61 requests in a minute (if limited to 60)429 with a Retry-After header, if documented

Common mistakes

  • Testing only with a valid admin token.
  • Checking the status code but not that nothing was stored.
  • Putting real tokens in screenshots or reports.

Try

Practise what you just read. Answers are checked here; nothing is graded publicly or counts toward Bug Arena.

Exercise

A request to update an order comes from a signed-in user who doesn't own that order. Which responses are acceptable? Select all that apply.

Select all that apply.

Review

Check yourself — you should now be able to:

  • Tell authentication from authorisation, and 401 from 403.
  • Design negative tests for invalid input.
  • Check that one user can't read or change another user's data.

References

Continue

When you’re ready, mark the lesson complete in the Try step and move on.

Marked as read when you reach the end of the lesson.