Network & Auth Practice Challenges

Practice HTTP Basic and Digest Auth, arbitrary status codes, request interception, cookies and slow responses against a real backend.

6 challenges

• The Vault · Basic Auth
• The Dead Drop · Digest Auth
• Protocol Lab · Status Codes
• The Midnight Pass · Session Timeout
• The Concierge Desk · Cookies & Storage
• Courier Dispatch Board · Request Interception

Frequently asked questions

How do I automate HTTP Basic and Digest Auth?

Basic Auth goes through the driver's credential API — Playwright httpCredentials, a Selenium 4 CDP/BiDi handler — because the browser prompt is not part of the DOM. Digest is challenge-response and most helpers do not speak it, so compute the MD5 response or use a client that does.

Can I assert HTTP status codes from a browser test?

Yes — request the endpoint and read the response instead of inspecting the rendered page. /api/status/<code> serves real 2xx, 3xx, 4xx and 5xx responses, and 301 and 302 perform genuine redirects so a redirect chain is assertable.

Do these challenges need a backend running?

The auth, status-code, slow-response and live-download exercises use the site's small stateless API and say so on the page when it is unreachable. Request interception, cookies and session timeout need nothing but the browser.

Other categories

• Forms & Inputs (9)
• Waits & Dynamics (8)
• Mouse & Keyboard (6)
• Frames, Windows & DOM (7)
• Data & Files (3)

Updated 2026-09-07

Fun UI Playground — all challenges, bug hunts, getting started, glossary, about.