API testing with Bearer token
API testing with Bearer token
HTTP Authentication Schemes:
HTTP Authentication verifies the user's eligibility to access the web resource. It involves HTTP header-based communication between the client and the server, with the server requesting the user's credentials for authentication.
I'll start by writing about bearer tokens because I recently learnt about them.
When a user logs in, the authentication server generates a token known as a bearer token. This token should be sent in the header of the client's subsequent calls .This token will shortly expire; in such circumstances, a new token must be generated.
Application using Bearer token:
The Contact List App is a small program that Kristin Jackvony created for testing. The APIs for this application authenticate users using bearer tokens.
API documentation can be found https://documenter.getpostman.com/view/4012288/TzK2bEa8
I started by exploring the app's functionality , making a list of prospective test scenarios.
The User signups with an email and password.
Then with that User id, login to the application.
Add contacts (First Name,Last Name are required fields), Date of birth, Email,Phone ,Address 1, City,State,Postal code, Country.
The added contact can be edited (First Name,Last Name are required fields) and other fields are not mandatory.
Delete a contact.
Viewing User’s profile, Editing and Deleting user can not be done from the UI. Per documentation, this can be done via API.
For my API testing, I also used the same test scenarios.
API test cases:
Expected Response:
I did this in Python as well:
I discovered that this “create User” API needs a Bearer Token as I read the API documentation. I had to login with a user I created from the UI in order to obtain the Bearer token. I therefore made the POST API Login call and received the bearer token in return. When creating a user API request, use this token:
In Python:
Here also use the same bearer token we received for the new user we created in Use Case 2.
Here, ADD contact test can be sent with only the required fields, without the required fields, with valid and invalid data, etc..
Once the contact was created, I sent a GET request with the contact ID retrieved from ADD contact to verify the contact's creation.
Then I updated the contact with the contact ID retrieved from ADD contacts.
Similarly I deleted the added contact as well.
Updating, and deleting user profiles would be added later to the tests.
The full code
import requests
import json
import random
contact_id={}
bearer_token = ""
user_name ="nsuba.skannan@gmail.com"
new_user = "ab"+str(random.randint(1,1000))+"@abc.com"
# This function logs in to contact list application and returns bearer token for the user.
# The token is sent in headers of all other actions :
# Add user,Add a new contact to the list, get the new contact ID,Update the newly created contact
# Delete the newly created contact
def user_login(user_name):
url = "https://thinking-tester-contact-list.herokuapp.com/users/login"
payload = json.dumps({
"email": user_name,
"password": "Sivaom1$"
})
headers = {'Content-Type': 'application/json'}
response = requests.request("POST", url, headers=headers, data=payload)
json_response = response.json()
#print (response.text)
bearer_token = json_response['token']
#print(bearer_token)
return bearer_token
#add New user
def addUser_profile():
url = "https://thinking-tester-contact-list.herokuapp.com/users"
token = user_login(user_name)
payload=json.dumps({
'firstName': 'fkjhjk',
'lastName': 'fkgjlk',
'email': new_user,
'password': 'Sivaom1$'
})
headers = {
'Authorization': 'Bearer '+token,
'Content-Type': 'application/json'
}
print (payload)
response = requests.request("POST", url, headers=headers, data=payload)
print(response.text)
def getContacts():
url = "https://thinking-tester-contact-list.herokuapp.com/contacts"
token=user_login(new_user)
payload = {}
headers = {
'Authorization': 'Bearer '+token
}
response = requests.request("GET", url, headers=headers, data=payload)
print("Contacts List")
print(response.text)
def addContacts():
url = "https://thinking-tester-contact-list.herokuapp.com/contacts"
token = user_login(new_user)
#print(token)
payload = json.dumps({
"firstName": "John",
"lastName": "Doe",
"birthdate": "1970-01-01",
"email": "jdoe@fake.com",
"phone": "8005555555",
"street1": "1 Main St.",
"street2": "Apartment A",
"city": "Anytown",
"stateProvince": "KS",
"postalCode": "12345",
"country": "USA"
})
headers = {
'Authorization': 'Bearer '+token,
'Content-Type': 'application/json'
}
response = requests.request("POST", url, headers=headers, data=payload)
print("New Contact Added: ")
print(response.text)
json_response = response.json()
contact_id["id"]=json_response["_id"]
def updateContact():
url = "https://thinking-tester-contact-list.herokuapp.com/contacts/"+contact_id['id']
token = user_login(new_user)
payload = json.dumps({
"firstName": "Nathan"
})
headers = {
'Authorization': 'Bearer ' + token,
'Content-Type': 'application/json'
}
response = requests.request("PATCH", url, headers=headers, data=payload)
print("New Contact Updated: ")
print(response.text)
def deleteContact():
url = "https://thinking-tester-contact-list.herokuapp.com/contacts/"+contact_id['id']
token = user_login(new_user)
headers = {
'Authorization': 'Bearer ' + token,
'Content-Type': 'application/json'
}
response = requests.request("DELETE", url, headers=headers)
print(response.text)
addUser_profile()
addContacts()
getContacts()
updateContact()
getContacts()
deleteContact()
getContacts()
Comments
Post a Comment