ASP.NET Core Web API Interview Question #157

How should authentication be tested in API integration tests?

Testing, HttpClient, Integration Testing, Background Services & Deployment Senior Advanced

Quick Interview Answer

Tests should cover both authenticated and unauthenticated behavior and verify important authorization boundaries. A test authentication scheme can create controlled identities and claims without requiring the real external identity provider.

Detailed Explanation

Separate tests can verify the real identity integration where necessary, while most API authorization tests remain deterministic and fast.

Code Example

client.DefaultRequestHeaders.Authorization =
    new AuthenticationHeaderValue("Test", "admin-user");

var response = await client.DeleteAsync("/api/products/10");

Assert.Equal(HttpStatusCode.NoContent, response.StatusCode);