JWT Login

How it works

Token-based APIs split authentication into two steps. First the client posts its credentials to a login endpoint and receives a token. After that, it sends the token on every call instead of the password. The most common token format is the JSON Web Token: three Base64URL segments joined by dots, a header, a payload of claims and a signature.

testkru POST /auth/login accepts the course username and password as JSON and returns a body with token and user. Decoding the middle segment shows the claims: sub holds the username, iat the issue time and exp an expiry one hour later. Because iat counts whole seconds, a login in any later second gives a different token.

That changing value is why a test must never compare the token to a fixed string. Check what is stable instead: the status, the user field and the fact that a token exists. Missing fields get 400, wrong credentials 401.

About the assignment

Log in with the course credentials and show that it worked, reporting the user and whether a token came back but never the token itself.

What you will do

1. 1POST the username and password from the starter comment to /auth/login as a JSON body.
2. 2Print the status code after Status:.
3. 3Read user with getString() and print it after User:.
4. 4Read token the same way, test that it is not null, and print only that boolean after Has token:.

Common mistakes

• Printing or asserting the token value

  The token embeds the issue time, so it differs between runs and any exact comparison fails. Assert presence, or decode it and check the sub claim.

• Leaving out the JSON content type

  A String body with no content type goes out as plain text. The server finds no username or password in it and answers 400 for missing fields, which looks like a credentials problem but is not.

• Logging in for every test

  Login endpoints are usually rate limited, and testkru allows only a handful of auth calls per minute. Log in once per class and reuse the token while it is valid.

In a real test suite

Related lessons

• Bearer Token AuthenticationUses the token from this login to call a protected endpoint.
• API Workflow - Authentication and OrderLogs in the same way, then sends the token as a Bearer header on an order POST.
• Create a User with POSTAnother JSON POST, creating a user instead of starting a session.

To try one of these calls on any API endpoint without a task, open the Online Selenium Java Compiler (REST Assured is included).

Starter code

The editor above opens with this code. Fill in the TODO lines, then run and submit it.

import io.restassured.RestAssured;
import io.restassured.response.Response;
import io.restassured.specification.RequestSpecification;
import io.restassured.http.ContentType;
import static io.restassured.RestAssured.*;

public class Main {
    public static void main(String[] args) {
        RestAssured.baseURI = "https://testkru.com/api";

        // TODO: POST to /auth/login with body: {"username": "admin", "password": "secret123"}
        // TODO: Print status and user
        // TODO: Check if token exists (not null) and print "Has token: true/false"
        // WARNING: Do NOT print the token itself — it changes every time!
    }
}