Skip to main content
2026-07-29 16:01
REST API

Basic Authentication

AuthRequestValidateEasy
Try Interactive Demo

What you will learn

  • Base64 is NOT encryption — Basic Auth requires HTTPS end-to-end or credentials leak
  • Test both missing and malformed Authorization headers — they produce different errors
  • Assert that credentials never appear in URLs, redirects, or error responses

Description

Authenticate using Base64-encoded username:password in Authorization header.

Test Scenario

const auth = Buffer.from('test@example.com:password123').toString('base64');
const response = await request.get('/api/v1/auth/basic', {
  headers: { 'Authorization': 'Basic ' + auth }
});
expect(response.status()).toBe(200);
Endpoint/api/v1/auth/basic

Testing Tips

  • •Encode username:password in Base64
  • •Set Authorization: Basic <encoded>
  • •Check 401 for invalid credentials
// Playwright - Basic Auth
import { test, expect } from '@playwright/test';


test('Basic Authentication', async ({ request }) => {
  const credentials = Buffer.from('test@example.com:password123').toString('base64');


  const response = await request.get('/api/v1/auth/basic', {
    headers: {
      'Authorization': `Basic ${credentials}`
    }
  });


  expect(response.ok()).toBeTruthy();
  // Basic auth returns: { message, authMethod, user: { email }, protectedData }
  const body = await response.json();
  expect(body.authMethod).toBe('Basic');
  expect(body.user.email).toBe('test@example.com');
});


test('Invalid Basic Auth returns 401', async ({ request }) => {
  const response = await request.get('/api/v1/auth/basic');
  expect(response.status()).toBe(401);
});

Challenge ID: rest-auth-basic

2 frameworks available

API Playground

Send requests and inspect responses

Endpoint: /api/v1/auth/basic

Press Enter to send