Test Auth Protection

Having implemented access controls across your frontend and backend layers, you can now execute these test cases to validate that your protections are working correctly.

Test 1: Verify Frontend Blocks Unauthenticated Access

Protected frontend routes and components should reject unauthenticated access. Follow these steps to test this functionality:

1. First, make sure your user does not have an active session. Run the logout flow by entering your Logout Endpoint URL (e.g., http://localhost:3001/auth/logout) into your browser's address bar and pressing Enter.
2. With your user logged out, enter the URL of a protected route into your browser's address bar and press Enter.
3. If your authentication checks are configured correctly, you will be automatically redirected to your application's login page.

Test 2: Verify Backend Blocks Unauthenticated Access

Protected backend endpoints must return a 401 Unauthorized response if a request lacks a valid session cookie. Follow these steps to test this functionality:

1. Send a request to a protected backend endpoint using cURL or Postman without including a valid session cookie.
2. Verify that the endpoint returns a 401 Unauthorized response.

Test 3: Verify Authenticated Users Can Access Protected Pages

Next, test the successful path by accessing a protected page with a logged-in user. The authentication check should pass and grant access to the page. Perform the following steps:

To confirm that authenticated users can successfully view your protected pages, complete these steps:

1. First, make sure the user is logged in by entering your Login Endpoint URL (e.g., http://localhost:3001/auth/login) into your browser's address bar and pressing Enter.
2. Complete the login flow by entering your credentials when prompted.
3. Once authenticated, you will be automatically redirected back to your application, where you should now be able to view all protected pages.

If these tests pass, your authentication checks are configured and working correctly.