Building Enterprise JavaScript Applications

Writing tests

Now that we have decided to attach our token using the Authorization header with the Bearer scheme, our next action is to write the tests for this authentication system. For our use cases, let's say that all endpoints that alter a user's document (that is, all POST, PATCH, and PUT requests except /login) will require a token where the sub property matches the ID of the user.

As always, we begin development by writing tests. Let's start with the Delete User endpoint, which should respond with the following:

• 200 OK if the Authorization header is set to a well-formed credential (for example, it has the structure username:bcrypt-digest. We will verify whether these credentials correspond with a real user in the next step; right ...