Basic Authentication

How it works

HTTP Basic authentication puts a username and password in the Authorization header as Basic followed by the Base64 encoding of the two values joined by a colon. Base64 is an encoding, not encryption, so Basic auth is only acceptable over HTTPS.

REST Assured offers two modes. auth().preemptive().basic(user, pass) attaches the header to the first request. Plain auth().basic(user, pass) sends nothing at first and waits for the server to answer 401 with a WWW-Authenticate challenge, then repeats the call with credentials. An echo endpoint shows the difference clearly: the preemptive form arrives with the header, the challenged form arrives without it, because the echo never challenges.

testkru /auth/basic does send that challenge, so both modes reach a 200 here, but the challenged one costs an extra round trip. Wrong credentials get 401, a WWW-Authenticate header naming the realm, and an error message. On success the body has a message and the user the server decoded from your header.

About the assignment

Authenticate against the Basic auth endpoint with the course credentials, sending them up front, and print the status plus what the server says about you.

What you will do

1. 1Start from given() and use auth(), then preemptive(), then basic() with the username and password from the task.
2. 2GET /auth/basic and keep the Response.
3. 3Print the status code after Status:.
4. 4Read message and user with getString() and print them after Message: and User:.

Common mistakes

• Dropping preemptive() against servers that do not challenge

  Many APIs answer a missing credential with 401 and no WWW-Authenticate header, or with 403. The challenged mode then never retries and the test fails though the password is right.

• Building the header by hand

  It works, but it is easy to forget the colon or the Basic prefix. Let basic() do the encoding, and keep the raw value out of your code.

• Logging credentials

  A log().all() on this request prints the Authorization header, and its Base64 value decodes straight back to the password. Blacklist the header in log config on real systems.

In a real test suite

Related lessons

• API Key AuthenticationA different scheme: a static API key in a custom header.
• Bearer Token AuthenticationToken-based auth with Authorization: Bearer after a login call.
• Handle 401 UnauthorizedWhat a protected endpoint returns when no credentials arrive.

To try one of these calls on any API endpoint without a task, open the Online Selenium Java Compiler (REST Assured is included).

Starter code

The editor above opens with this code. Fill in the TODO lines, then run and submit it.

import io.restassured.RestAssured;
import io.restassured.response.Response;
import io.restassured.specification.RequestSpecification;
import static io.restassured.RestAssured.*;

public class Main {
    public static void main(String[] args) {
        RestAssured.baseURI = "https://testkru.com/api";

        // TODO: GET /auth/basic with preemptive basic auth (admin / secret123)
        // TODO: Print status, message, and user from response
    }
}