Tutorials123: Digest Authentication

What is Digest Authentication?

Digest Authentication is a security mechanism used by servers to verify the identity of a client (user or system) before allowing access to protected resources.
Unlike Basic Authentication (where username and password are sent in plain text encoded with Base64)

Digest Authentication is more secure because:

It applies a hashing algorithm (like MD5/SHA) to the credentials before sending them over the network.
The server sends a nonce (a random value) to the client.
The client combines the nonce, username, password, HTTP method, and requested URI → then hashes them → and sends the hashed value back.
The server performs the same hashing process and compares results. If they match → authentication succeeds.

How to test Digest Authentication in Rest Assured

In Rest Assured, testing Digest Authentication involves these steps:

1. Specify authentication type as Digest

Instead of default/basic authentication, explicitly tell Rest Assured to use digest authentication.

2. Provide credentials

Pass the username and password required by the server for authentication.

3. Send the request

Rest Assured automatically performs the handshake with the server (sending nonce, hashing, etc.).

4. Validate the response

Once authenticated, the server will return the protected resource.
You can then test the response body, status code, or headers to confirm access was granted.

API Endpoint for Testing:

https://httpbin.org/digest-auth/auth/user/passwd

This endpoint expects:

Username: user
Password: passwd

Steps to Use Digest Auth in Rest Assured:

Maven dependencies:

<!-- Maven Dependency -->
<dependency>
    <groupId>io.rest-assured</groupId>
    <artifactId>rest-assured</artifactId>
    <version>5.4.0</version>
    <scope>test</scope>
</dependency>

Java Code: Digest Auth with Rest Assured

import io.restassured.RestAssured;
import static io.restassured.RestAssured.*;
import static org.hamcrest.Matchers.*;

public class DigestAuthExample {

    public static void main(String[] args) {

        RestAssured.baseURI = "https://httpbin.org";

        given()
            .auth()
            .digest("user", "passwd") // Digest Auth
        .when()
            .get("/digest-auth/auth/user/passwd")
        .then()
            .statusCode(200)
            .body("authenticated", equalTo(true))
            .body("user", equalTo("user"))
            .log().all(); // Print full response
    }
}

Code explanation:

(a) Set base URI

(b) Set request by digest authentication code

Output:

{
  "authenticated": true,
  "user": "user"
}

Above is the response of API which is logged on console.

How to test Digest Auth by using Rest Assured