.../EntityResource/Media/MediaHalJsonAnonTest.php  | 54 ++++++++++++++++++++++
 .../EntityResource/Media/MediaResourceTestBase.php | 34 ++++++++++----
 .../src/Functional/FileUploadResourceTestBase.php  |  2 +-
 3 files changed, 80 insertions(+), 10 deletions(-)

diff --git a/core/modules/hal/tests/src/Functional/EntityResource/Media/MediaHalJsonAnonTest.php b/core/modules/hal/tests/src/Functional/EntityResource/Media/MediaHalJsonAnonTest.php
index c9ee773..c5ca04a 100644
--- a/core/modules/hal/tests/src/Functional/EntityResource/Media/MediaHalJsonAnonTest.php
+++ b/core/modules/hal/tests/src/Functional/EntityResource/Media/MediaHalJsonAnonTest.php
@@ -154,6 +154,60 @@ protected function getExpectedNormalizedEntity() {
   /**
    * {@inheritdoc}
    */
+  protected function getExpectedNormalizedFileEntity() {
+    $normalization = parent::getExpectedNormalizedFileEntity();
+
+    $owner = static::$auth ? $this->account : User::load(0);
+
+    // Cannot use applyHalFieldNormalization() as it uses the $entity property
+    // from the test class, which in the case of file upload tests, is the
+    // parent entity test entity for the file that's created.
+
+    // The HAL normalization adds entity reference fields to '_links' and
+    // '_embedded'.
+    unset($normalization['uid']);
+
+    return $normalization + [
+      '_links' => [
+        'self' => [
+          // @todo This can use a proper link once
+          // https://www.drupal.org/project/drupal/issues/2907402 is complete.
+          // This link matches what is generated from from File::url(), a
+          // resource URL is currently not available.
+          'href' => file_create_url($normalization['uri'][0]['value']),
+        ],
+        'type' => [
+          'href' => $this->baseUrl . '/rest/type/file/file',
+        ],
+        $this->baseUrl . '/rest/relation/file/file/uid' => [
+          ['href' => $this->baseUrl . '/user/' . $owner->id() . '?_format=hal_json']
+        ],
+      ],
+      '_embedded' => [
+        $this->baseUrl . '/rest/relation/file/file/uid' => [
+          [
+            '_links' => [
+              'self' => [
+                'href' => $this->baseUrl . '/user/' . $owner->id() . '?_format=hal_json',
+              ],
+              'type' => [
+                'href' => $this->baseUrl . '/rest/type/user/user',
+              ],
+            ],
+            'uuid' => [
+              [
+                'value' => $owner->uuid(),
+              ],
+            ],
+          ],
+        ],
+      ],
+    ];
+  }
+
+  /**
+   * {@inheritdoc}
+   */
   protected function getNormalizedPostEntity() {
     return parent::getNormalizedPostEntity() + [
       '_links' => [
diff --git a/core/modules/rest/tests/src/Functional/EntityResource/Media/MediaResourceTestBase.php b/core/modules/rest/tests/src/Functional/EntityResource/Media/MediaResourceTestBase.php
index 8ed41ee..07835d6 100644
--- a/core/modules/rest/tests/src/Functional/EntityResource/Media/MediaResourceTestBase.php
+++ b/core/modules/rest/tests/src/Functional/EntityResource/Media/MediaResourceTestBase.php
@@ -297,7 +297,7 @@ public function testPost() {
     $this->assertTrue($file->isTemporary());
     $this->assertFalse($file->isPermanent());
 
-    // Step 1: create Media entity using the File, makes File entity permanent.
+    // Step 2: create Media entity using the File, makes File entity permanent.
     parent::testPost();
     $file = $file_storage->loadUnchanged(3);
     $this->assertFalse($file->isTemporary());
@@ -322,6 +322,8 @@ protected function uploadFile() {
     ])->save();
     $this->refreshTestStateAfterRestConfigChange();
 
+    $this->initAuthentication();
+
     // POST to create a File entity.
     $url = Url::fromUri('base:file/upload/media/camelids/field_media_file');
     $url->setOption('query', ['_format' => static::$format]);
@@ -341,9 +343,30 @@ protected function uploadFile() {
     $this->grantPermissionsToTestedRole(['create camelids media']);
     $response = $this->request('POST', $url, $request_options);
     $this->assertSame(201, $response->getStatusCode());
+    $expected = $this->getExpectedNormalizedFileEntity();
+    static::recursiveKSort($expected);
+    $actual = $this->serializer->decode((string) $response->getBody(), static::$format);
+    static::recursiveKSort($actual);
+    $this->assertSame($expected, $actual);
+
+    // To still run the complete test coverage for POSTing a Media entity, we
+    // must revoke the additional permissions that we granted.
+    $role = Role::load(static::$auth ? RoleInterface::AUTHENTICATED_ID : RoleInterface::AUTHENTICATED_ID);
+    $role->revokePermission('create camelids media');
+    $role->trustData()->save();
+  }
+
+  /**
+   * Gets the expected file entity.
+   *
+   * @return array
+   *   The expected normalized data array.
+   */
+  protected function getExpectedNormalizedFileEntity() {
     $file = File::load(3);
     $owner = static::$auth ? $this->account : User::load(0);
-    $expected_file_entity_normalization = [
+
+    return [
       'fid' => [
         [
           'value' => 3,
@@ -400,13 +423,6 @@ protected function uploadFile() {
         $this->formatExpectedTimestampItemValues($file->getChangedTime()),
       ],
     ];
-    $this->assertSame($expected_file_entity_normalization, Json::decode((string) $response->getBody()));
-
-    // To still run the complete test coverage for POSTing a Media entity, we
-    // must revoke the additional permissions that we granted.
-    $role = Role::load(static::$auth ? RoleInterface::AUTHENTICATED_ID : RoleInterface::AUTHENTICATED_ID);
-    $role->revokePermission('create camelids media');
-    $role->trustData()->save();
   }
 
   /**
diff --git a/core/modules/rest/tests/src/Functional/FileUploadResourceTestBase.php b/core/modules/rest/tests/src/Functional/FileUploadResourceTestBase.php
index 564ecaa..dc9f138 100644
--- a/core/modules/rest/tests/src/Functional/FileUploadResourceTestBase.php
+++ b/core/modules/rest/tests/src/Functional/FileUploadResourceTestBase.php
@@ -496,7 +496,7 @@ protected function assertNormalizationEdgeCases($method, Url $url, array $reques
    * {@inheritdoc}
    */
   protected function getExpectedUnauthorizedAccessMessage($method) {
-    return "The following permissions are required: 'administer entity_test content' OR 'administer entity_test_with_bundle content' OR 'create  entity_test_with_bundle entities'.";
+    return "The following permissions are required: 'administer entity_test content' OR 'administer entity_test_with_bundle content' OR 'create entity_test entity_test_with_bundle entities'.";
   }
 
   /**