How to test Form Authentication by using rest Assured

 

Form authentication is typically used by web applications that present a login form where users enter credentials (like username/password), and those are sent as part of the form (usually POST request). Once the server validates the credentials, it may set a session cookie or token which is used for subsequent requests.

How Form Auth Works in Rest Assured:

Rest Assured provides:

.formAuth(loginUrl, usernameField, passwordField, username, password)

This simulates a form-based login by:

• Making a POST request to the login URL
• Submitting the credentials using field names (like username, password)
• Then it stores session/cookie for further requests like GET, POST, etc.

Sample API for Form Auth

We will use: https://the-internet.herokuapp.com/login (a public test site)

• Login URL: https://the-internet.herokuapp.com/authenticate

• Username Field Name: username

• Password Field Name: password

• Username: tomsmith

• Password: SuperSecretPassword!

Java Code with Rest Assured:

 

import io.restassured.RestAssured;
import io.restassured.filter.session.SessionFilter;
import static io.restassured.RestAssured.*;

public class FormAuthExample {
    public static void main(String[] args) {

        // Create session filter to maintain session across requests
        SessionFilter session = new SessionFilter();

        // Step 1: Log in using form-based auth
        given()
            .baseUri("https://the-internet.herokuapp.com")
            .filter(session)
            .formParam("username", "tomsmith")
            .formParam("password", "SuperSecretPassword!")
        .when()
            .post("/authenticate")
        .then()
            .statusCode(302);  // Expect redirect on successful login

        // Step 2: Access GET API after login
        given()
            .baseUri("https://the-internet.herokuapp.com")
            .filter(session)
        .when()
            .get("/secure")
        .then()
            .statusCode(200)
            .log().body();  // Print response to confirm access
    }
}

Maven Dependencies

<dependencies>
    <dependency>
        <groupId>io.rest-assured</groupId>
        <artifactId>rest-assured</artifactId>
        <version>5.4.0</version>
        <scope>test</scope>
    </dependency>
</dependencies>

How to test Digest Auth by using Rest Assured

 

Digest Authentication in Rest Assured is a more secure authentication mechanism than Basic Auth. It involves hashing credentials and using a server challenge-response mechanism, and Rest Assured supports it using the .auth().digest() method.

What is Digest Authentication?

Digest Authentication is an authentication scheme that:

• Sends credentials in an encrypted form.

• Uses a nonce (number used once) sent by the server.

• Provides protection against man-in-the-middle attacks.

API Endpoint for Testing:

https://httpbin.org/digest-auth/auth/user/passwd

This endpoint expects:

• Username: user

• Password: passwd

Steps to Use Digest Auth in Rest Assured:

Maven dependencies:

<!-- Maven Dependency -->
<dependency>
    <groupId>io.rest-assured</groupId>
    <artifactId>rest-assured</artifactId>
    <version>5.4.0</version>
    <scope>test</scope>
</dependency>

Java Code: Digest Auth with Rest Assured

import io.restassured.RestAssured;
import static io.restassured.RestAssured.*;
import static org.hamcrest.Matchers.*;

public class DigestAuthExample {

    public static void main(String[] args) {

        RestAssured.baseURI = "https://httpbin.org";

        given()
            .auth()
            .digest("user", "passwd") // Digest Auth
        .when()
            .get("/digest-auth/auth/user/passwd")
        .then()
            .statusCode(200)
            .body("authenticated", equalTo(true))
            .body("user", equalTo("user"))
            .log().all(); // Print full response
    }
}

Output:

{
  "authenticated": true,
  "user": "user"
}

Code Explanation:

Step	What it does
.auth().digest()	Enables Digest Authentication
.get("/digest-auth/auth/user/passwd")	Makes the authenticated GET request
.body(...).log().all()	Verifies the response and logs