Practice Exercises

Theory without practice is useless. Here are hands-on exercises that cover everything from this chapter. Do them in order. Each one builds on the previous.

Exercise 1: Basic Auth with Postman

1. Open Postman and create a new collection called "Auth Testing Practice"
2. Find any public API that supports Basic Auth (e.g., httpbin.org/basic-auth/user/pass)
3. Send a GET request with correct credentials — verify 200
4. Send with wrong password — verify 401
5. Send with no auth — verify 401
6. Open the Postman Console and inspect the Authorization header — decode the Base64 manually

Exercise 2: JWT Token Flow

1. Use this platform's /api/auth endpoints or any JWT-based API
2. Send a POST to the login endpoint with valid credentials
3. Extract the token from the response
4. Copy the token and paste it into jwt.io — identify the claims (sub, exp, iat, role)
5. Save the token as {{authToken}} in your Postman environment
6. Send a GET request to a protected endpoint with the Bearer token — verify 200
7. Modify one character in the token and resend — verify 401 (tampered token)

Exercise 3: Auto-Token Refresh Script

1. Add the auto-token pre-request script from Lesson 10 to your collection
2. Set up environment variables: baseUrl, testEmail, testPassword
3. Remove the authToken variable manually
4. Send any request — verify the script auto-fetches a token
5. Check the Postman Console to see "Token missing or expired. Fetching new token..." message
6. Send another request immediately — verify it uses the cached token (no re-login)
7. Manually set tokenExpiry to 0 and resend — verify it refreshes

Exercise 4: IDOR Testing

1. Using the Banking portal or any authenticated API:
2. Login as User A — note the user ID and any resource IDs
3. Login as User B — get a different token
4. Try to access User A's resources using User B's token
5. Verify you get 403 (not 200)
6. If you get 200 — congratulations, you found a real IDOR bug! Document it.

Exercise 5: REST Assured Auth Framework

1. Create a new Maven project with REST Assured and TestNG
2. Write a BaseTest class with loginAndGetToken(), asAdmin(), asUser(), asGuest() methods
3. Write 3 positive tests: valid login, admin access, user profile access
4. Write 5 negative tests: no token, expired token, malformed token, wrong role, SQL injection in login
5. Run all tests and verify they pass
6. Generate a TestNG HTML report and review the results

Exercise 6: Security Checklist

1. Pick any authenticated endpoint from your test environment
2. Create a test for each row in the OWASP checklist from Lesson 9
3. Test for mass assignment: send "role: admin" in a profile update
4. Test for information leakage: send invalid input and check if error reveals stack traces
5. Test for broken auth: verify passwords are never returned in responses
6. Document your findings in a simple table: Endpoint | Vulnerability | Status | Notes