Express API Testing with Postman - A Comprehensive Guide

Testing Authentication Endpoints

Authentication is the foundation of user security in web applications. Think of it as the bouncer at the club door - it ensures only authorized users can access protected resources.

Our Express application implements a token-based authentication system using JWT (JSON Web Tokens) stored in HTTP-only cookies.

Testing User Signup

First, let's test the signup endpoint which creates a new user.

Add the following JSON body:

{
    "email": "test@example.com",
    "username": "testuser",
    "password": "password123",
    "firstName": "Test",
    "lastName": "User"
}
                

Send this request. You should receive a 200 status and a response containing the user information (without the password). The response should look something like:

{
    "user": {
        "id": 4,
        "email": "test@example.com",
        "username": "testuser",
        "firstName": "Test",
        "lastName": "User"
    }
}
                

Additionally, check the "Cookies" tab in Postman. You should see a "token" cookie has been set. This is the JWT that will be used for authentication in subsequent requests.

Testing Signup Validation

Now let's test the input validation for the signup endpoint. Think of input validation as a bouncer checking IDs - it's the first line of defense against bad data.

Create a new request called "User Signup Validation Test" similar to the previous one, but with invalid data:

{
    "email": "not-an-email",
    "username": "a",
    "password": "short"
}
                

Send this request. You should receive a 400 Bad Request status and a response with validation errors:

{
    "title": "Bad request.",
    "message": "Bad request.",
    "errors": {
        "email": "Please provide a valid email.",
        "username": "Please provide a username with at least 4 characters.",
        "password": "Password must be 6 characters or more."
    }
}
                

Testing User Login

Next, let's test the login endpoint. First, make sure you've signed out (we'll create that request later) or are using a new Postman session.

Add the following JSON body to login with username:

{
    "credential": "testuser",
    "password": "password123"
}
                

Send this request. You should receive a 200 status and a response containing the user information:

{
    "user": {
        "id": 4,
        "email": "test@example.com",
        "username": "testuser",
        "firstName": "Test",
        "lastName": "User"
    }
}
                

Now let's try logging in with email instead of username. Create a new request or modify the previous one:

{
    "credential": "test@example.com",
    "password": "password123"
}
                

This should also return a 200 status with the same user information.

Testing Login Validation

Let's test the validation for the login endpoint:

{
    "credential": "",
    "password": "password123"
}
                

This should return a 400 status with an error about providing a valid credential.

Now test with an incorrect password:

{
    "credential": "testuser",
    "password": "wrongpassword"
}
                

This should return a 401 Unauthorized status with an error about invalid credentials.

Testing Get Current User Session

Let's test retrieving the current user's session information:

If you're logged in (have a valid token cookie), this should return the user's information:

{
    "user": {
        "id": 4,
        "email": "test@example.com",
        "username": "testuser",
        "firstName": "Test",
        "lastName": "User"
    }
}
                

If you're not logged in, it should return:

{
    "user": null
}
                

Testing User Logout

Finally, let's test the logout endpoint:

Send this request. You should receive a 200 status and a response like:

{
    "message": "success"
}
                

The "token" cookie should be cleared. You can verify this by running the "Get Current User" request again, which should now return { "user": null }.