Testing secured endpoints
On This Lesson 4 topics
This lesson is planned. The outline below lists the topics it will cover. The full lesson has not been published yet.
In this lesson
test authentication and authorization.
Planned topics
- Get a real token by logging in during the test (or from a test Keycloak) and send it in the
Authorizationheader. - With MockMvc you can use
@WithMockUseror JWT post-processors from Spring Security Test. - Test each role: allowed, forbidden, and anonymous.
- Test that a user cannot read another user's data.
- Never put real credentials in test code; use test users.
Draft outline details
Demonstration
given().port(port).header("Authorization", "Bearer " + token)
.when().get("/api/orders/" + otherUsersOrderId)
.then().statusCode(403);Check your understanding
A logged-in user opens an admin endpoint. Which status?
Show answer
403.
Practice
Apply this lesson with the module's lab, exercises and quiz.
Marking a lesson complete is optional and you can undo it any time. Your progress stays in this browser.