Understanding API Authorization with Katalon Studio

Authorization is essential in APIs to ensure secure access to data and services. It validates that the client making a request has the correct permissions to access or manipulate data, providing an added layer of security in web services. Whether you’re managing user credentials, making requests to a cloud service, or handling sensitive data like payments, proper authorization ensures that only verified entities can access the API.

Authorization information can be added directly through the Authorization tab in a web service request in Katalon Studio. By automating this process, Katalon Studio simplifies the complexity of managing different authentication methods, making it easier to secure APIs without manually handling security tokens or credentials.
 

Types of authorization supported in Katalon Studio

Katalon Studio supports various authorization types, each suited to different use cases. These include:

1. AWS Signature: A method for authorizing requests to Amazon Web Services (AWS). This employs a keyed Hash-Based Message Authentication Code (HMAC) to ensure secure access.
2. Bearer: Utilizes security tokens (bearer tokens) for HTTP authentication, commonly used in OAuth authorization flows.
3. Basic: The simplest authorization form sends an encoded username and password to the HTTP request headers.
4. Digest: An enhanced form of Basic authentication, utilizing MD5 hashing to prevent sensitive credentials from being transmitted in plaintext.
5. OAuth 1.0 & OAuth 2.0: Widely adopted industry standards that provide secure, token-based authorization. OAuth allows third-party applications to access user data without exposing credentials.
6. NTLM: A Windows-based authentication protocol commonly used in corporate environments involving domain-joined machines.

Starting in version 9.7.2, Katalon Studio introduces two new authorization methods: AWS Signature and Digest. These additions enhance the flexibility of authentication options, meeting a broader range of security needs. Learn more: Release notes.
 

AWS Signature authentication

Let’s say your company is using AWS for most of its infrastructure. You’re responsible for testing APIs that connect to AWS services, and you need a secure, automated way to handle API requests across multiple cloud services. Manually testing APIs with AWS can be time-consuming, error-prone, and insecure due to the need to manage IAM (identity and access management) users, generate access keys, and configure API clients while risking credential exposure.

AWS Signature authentication simplifies this process by securing API requests using a keyed HMAC (Hash-Based Message Authentication Code), ensuring that only authorized users can interact with AWS services.

How does AWS Signature authentication solve tester challenges?

1. Handling multiple cloud services: Testing APIs across different AWS regions can be complex. AWS Signature authentication automates the secure handling of these requests, reducing manual work.
2. Eliminating manual security setups: Configuring security manually for AWS API tests is a hassle. AWS Signature does it for you, reducing errors and saving time.
3. Ensuring secure API requests: AWS handles sensitive data, so secure API interactions are critical. AWS Signature makes sure that all API requests are properly authenticated.

How to set up AWS Signature authentication in Katalon Studio:

1. Open any API project with Katalon Studio.

2. Go to Object Repository and create a Web Service Request.

3. In the Authorization tab, select AWS Signature from the dropdown.

4. Enter your Access Key and Secret Key (to obtain access keys and secret keys for your AWS API requests, log in to the AWS Management Console, navigate to IAM, create a user with appropriate permissions, and generate access keys, ensuring secure storage of the downloaded CSV or copied credentials).

5. Choose where to add the auth data (in the request headers or URL).

6. Configure optional fields like AWS Region and Service Name.

7. Click Update and your credentials are secured for data exchange with AWS.

8. Send the request and verify the response.

By automating the secure data exchange with AWS, AWS Signature authentication helps testers focus on the tests without worrying about the complexity of manual security setups.
 

Digest authentication

Sending sensitive data like usernames and passwords in plain text is a huge risk. However, manually setting up Digest authentication for API testing involves configuring the server, creating a password file, implementing Digest authentication in the API client, and sending authenticated requests.

Digest authentication uses a hashed version of the credentials instead of plain text. Think of it as sending a secure, locked box instead of an open letter.

What problems does Digest authentication solve?

1. Preventing password exposure: Basic authentication exposes credentials in plain text, Digest authentication avoids this by sending a secure, encrypted hash.
2. Blocking replay attacks: Digest authentication generates a unique one-time code, making it impossible for hackers to reuse intercepted credentials.
3. Optimized for web testing: Digest authentication offers better security for APIs tested over the internet than methods like Windows authentication.

How to set up Digest authentication in Katalon Studio:

1. Open any API project with Katalon Studio.

2. Go to Object Repository and create a Web Service Request.

3. In the Authorization tab, select Digest from the dropdown menu.

4. Enter your username and password.

5. Choose whether to let Katalon handle authentication automatically or manually configure advanced options like nonce and realm.

6. Click Update to apply Digest authentication to your web service request.

7. Send the request and verify the response.
 

Why does secure authentication matter for testers?

If you’re a tester, you’ve likely encountered tight deadlines, complicated testing environments, and the need to protect sensitive data. Katalon Studio supports various types of authentication methods, making these challenges easier to manage by ensuring that your tests are secure and reducing the time spent on manual setup. 

Common pain points solved by Katalon Studio’s authentication:

• Balancing speed and security: There’s often a trade-off between moving quickly and ensuring security. With built-in authentication, you can secure your tests without sacrificing speed.
• Handling sensitive data: APIs dealing with sensitive information, like payment systems, require extra protection. These authentication methods ensure that sensitive data is never exposed during testing.
• Manual setup hassles: Manually configuring secure API tests takes time and introduces potential errors. Katalon Studio automates these processes, reducing the chance of mistakes and speeding up the testing workflow.

Conclusion

With wide support for various authorization methods, Katalon Studio simplifies the process of securing API tests. The addition of AWS Signature and Digest authentication enhances the tool’s ability to handle complex, secure environments—giving developers the flexibility to automate authorization workflows across various platforms.

Download Katalon Studio now, and take advantage of these new capabilities and streamline secure access management in your testing processes.

Download Katalon Studio