Playwright Authentication Handling (Basic Auth, OAuth, JWT & Session Management) Using Java

Introduction

Authentication is one of the first challenges automation engineers face when testing modern web applications. Whether you're working with an internal enterprise application, an e-commerce platform, or a cloud-based SaaS product, your tests often need to log in before performing business operations.

Repeatedly logging in before every test slows execution and increases maintenance. Playwright provides several mechanisms to handle authentication efficiently, including Basic Authentication, OAuth flows, JWT tokens, cookies, and session reuse.

In this guide, you'll learn the most common authentication techniques used in Playwright with Java and when to use each approach.

---

Why Authentication Matters in Automation

Authentication enables secure access to protected resources and user-specific functionality.

Common authentication methods include:

• Username and password
• HTTP Basic Authentication
• OAuth 2.0
• JWT (JSON Web Tokens)
• Session cookies
• Single Sign-On (SSO)

A good automation framework should support all of these without duplicating login logic across tests.

---

HTTP Basic Authentication

Basic Authentication sends a username and password with every request.

Playwright supports it during browser context creation.

BrowserContext context =
    browser.newContext(
        new Browser.NewContextOptions()
            .setHttpCredentials(
                "admin",
                "password123"
            )
    );

Page page = context.newPage();

page.navigate("https://example.com");

This is commonly used for internal tools or protected staging environments.

---

Form-Based Login

Most applications use login forms.

Example:

page.navigate("https://example.com/login");

page.fill("#username", "admin");

page.fill("#password", "password123");

page.click("#loginButton");

page.waitForURL("**/dashboard");

Playwright automatically waits for navigation and element readiness.

---

Reusing Logged-In Sessions

Logging in before every test increases execution time.

Instead, log in once and reuse the authenticated session.

After a successful login:

context.storageState(
    new BrowserContext.StorageStateOptions()
        .setPath(Paths.get("storageState.json"))
);

This saves cookies and local storage to a file.

---

Loading a Saved Session

Reuse the saved session in future tests.

BrowserContext context =
    browser.newContext(
        new Browser.NewContextOptions()
            .setStorageStatePath(
                Paths.get("storageState.json")
            )
    );

Page page = context.newPage();

This allows tests to start in an authenticated state without repeating the login process.

---

Working with Cookies

Applications often use cookies to maintain user sessions.

Retrieve cookies:

List<BrowserContext.Cookie> cookies =
        context.cookies();

System.out.println(cookies.size());

You can also inspect individual cookie properties for debugging or validation.

---

Adding Cookies Manually

Sometimes it's useful to inject cookies directly.

BrowserContext.Cookie cookie =
        new BrowserContext.Cookie();

cookie.setName("sessionId");
cookie.setValue("ABC123");
cookie.setDomain("example.com");
cookie.setPath("/");

context.addCookies(
        List.of(cookie)
);

This is useful when preparing pre-authenticated sessions.

---

JWT Token Authentication

Many REST APIs and Single Page Applications (SPAs) use JSON Web Tokens.

You can send a JWT token in request headers.

APIRequestContext request =
    playwright.request().newContext(
        new APIRequest.NewContextOptions()
            .setExtraHTTPHeaders(
                Map.of(
                    "Authorization",
                    "Bearer YOUR_JWT_TOKEN"
                )
            )
    );

This approach is common for API testing and backend integration.

---

OAuth Authentication

OAuth is widely used for social login providers such as:

• Google
• Microsoft
• GitHub
• LinkedIn

The typical flow is:

1. User clicks Sign in.
2. Browser redirects to the identity provider.
3. User authenticates.
4. Identity provider redirects back with an authorization code or token.

Automating OAuth directly can be complex because it often involves multi-factor authentication or third-party security policies.

In enterprise environments, a common practice is to authenticate once and reuse the saved session instead of repeating the entire OAuth flow.

---

API Login for Faster Tests

Instead of logging in through the UI, authenticate using an API and then open the browser with the authenticated session.

Typical flow:

1. Send login API request.
2. Receive session token or cookie.
3. Save authentication data.
4. Launch browser using the authenticated state.

This reduces execution time and avoids repetitive UI interactions.

---

Handling Session Expiration

Sessions may expire during long-running test suites.

To avoid failures:

• Refresh the session when necessary.
• Regenerate authentication tokens.
• Recreate the storage state periodically.
• Monitor token expiration times.

---

Multi-User Testing

Enterprise applications often require testing with multiple roles.

Example roles:

• Administrator
• Manager
• Employee
• Customer

Create a separate storage state file for each role.

storage/

├── admin.json

├── manager.json

├── employee.json

This keeps user sessions isolated and easy to manage.

---

Secure Credential Management

Never hardcode usernames or passwords in source code.

Instead, use:

• Environment variables
• Configuration files
• Secret management tools
• CI/CD pipeline secrets

This improves security and simplifies maintenance.

---

Best Practices

Reuse Sessions

Save authenticated sessions and reuse them whenever possible.

This significantly reduces test execution time.

---

Prefer API Login

When available, use backend authentication APIs instead of UI login for setup.

---

Isolate User Sessions

Each test should use its own browser context and session data.

Avoid sharing authenticated contexts across parallel tests.

---

Rotate Test Accounts

Use dedicated automation accounts and reset their state regularly to prevent unexpected failures.

---

Monitor Authentication Failures

Log authentication errors clearly so that expired credentials or configuration issues are easy to identify.

---

Common Interview Questions

What is storageState in Playwright?

storageState saves cookies and local storage so that authenticated sessions can be reused in later tests.

---

Why reuse authenticated sessions?

It speeds up execution, reduces repeated login operations, and improves test stability.

---

Can Playwright automate OAuth?

Yes, but many OAuth providers use additional security mechanisms such as MFA. In practice, teams often authenticate once and reuse the saved session.

---

How do you authenticate API requests using JWT?

Include the JWT token in the Authorization header using the Bearer scheme.

---

Why shouldn't credentials be hardcoded?

Hardcoded credentials create security risks and make maintenance more difficult. Externalized configuration is the recommended approach.

---

Conclusion

Authentication is a foundational aspect of web automation.

Playwright provides flexible options for handling Basic Authentication, form-based login, OAuth, JWT tokens, cookies, and reusable sessions, enabling automation engineers to build secure, fast, and maintainable test frameworks.

In this guide, you learned how to:

• Implement HTTP Basic Authentication
• Automate form-based login
• Save and reuse authenticated sessions
• Work with cookies
• Authenticate API requests using JWT
• Understand OAuth automation strategies
• Apply enterprise authentication best practices

By mastering these techniques, you'll build automation suites that execute faster, scale more effectively, and align with the authentication patterns used in modern enterprise applications.