# Post authentication token **URL:** \ **Category:** RSpec\ **Created:** [October 7, 2008, 4:01am UTC](https://www.ruby-forum.com/t/post-authentication-token/150301 "2008-10-07T04:01:28Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![markthomas](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/90db22/32.png) [@markthomas](https://www.ruby-forum.com/u/markthomas)\ **Post date:** [October 7, 2008, 4:01am UTC](https://www.ruby-forum.com/t/post-authentication-token/150301/1 "2008-10-07T04:01:28Z")
Hi, I have a simple story that involves the user clicking a button and a new page being rendered. Seems like a simple situation, but it’s testing my limited knowledge. The problem I have is my response test is failing, and I’m guessing it’s because the button click is meant to submit a post request with an authentication token, which would therefore have to be included in the post call in my scenario’s “when” step. My question is how do I go about determining the required value of the authentication\_token? Or am I just really confused? Mark. ---
**Author:** ![markthomas](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/90db22/32.png) [@markthomas](https://www.ruby-forum.com/u/markthomas)\ **Post date:** [October 7, 2008, 9:45am UTC](https://www.ruby-forum.com/t/post-authentication-token/150301/2 "2008-10-07T09:45:57Z")
This is actually a pretty tough problem for a newbie, and sent me reeling away from the story runner with my gumption in tatters the first time I tried it. You could probably figure out how to post an authentication token in the HTTP headers if you use the basic underlying rails integration session method post(), but you may be better off just walking through the steps a real user would carry out in order to log in: Given /logged in/ do visits “/login” fills\_in :username, “Matt” fills\_in :password, “secret” presses\_button end This is what we do, and though instinctively it feels a little bit slow and clunky to do this at the top of every scenario that requires the user to be authenticated, in practice it’s working fine for us, and I actually find it rather nice to know you’re only vaguely coupled to the implementation. Note that these steps above use the ‘webrat’ library which is the de- facto way to talk to your rails app from feature steps. ---
**Author:** ![markthomas](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/90db22/32.png) [@markthomas](https://www.ruby-forum.com/u/markthomas)\ **Post date:** [October 7, 2008, 3:15pm UTC](https://www.ruby-forum.com/t/post-authentication-token/150301/3 "2008-10-07T15:15:09Z")
Hmm, thanks. Still not sure if I’m diagnosing my problem correctly. Just to be clear, I don’t have any user authentication going on, just a regular Rails button\_to call. I tried installing webrat and put "visits ‘/’ " in my “given” step and “clicks\_button” in my “when” step. However I get an error from my\_story.rb - "No such file or directory - open tmp/webrat-12233801950.html. Presumably my issue would also apply in posting a form in a regular Rails integration test. The example on pp207-208 of AWDR doesn’t suggest that anything needs to be done in a post call to achieve session authentication. And I see here - [http://api.rubyonrails.org/classes/ActionController/RequestForgeryProtection/ClassMethods.html#M000693](http://api.rubyonrails.org/classes/ActionController/RequestForgeryProtection/ClassMethods.html#M000693) that forgery protection is actually turned off in testing - which I’ve confirmed in my config/environments/test.rb. So maybe I have some other problem causing my response test to fail. Any other suggestions would be appreciated. Mark. ---
**Author:** ![markthomas](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/90db22/32.png) [@markthomas](https://www.ruby-forum.com/u/markthomas)\ **Post date:** [October 7, 2008, 3:19pm UTC](https://www.ruby-forum.com/t/post-authentication-token/150301/4 "2008-10-07T15:19:16Z")
On Tue, Oct 7, 2008 at 8:36 AM, Mark T. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > And I see here - > [ActionController::RequestForgeryProtection::ClassMethods](http://api.rubyonrails.org/classes/ActionController/RequestForgeryProtection/ClassMethods.html#M000693) > that forgery protection is actually turned off in testing - which I’ve > confirmed in my config/environments/test.rb. So maybe I have some other > problem causing my response test to fail. Any other suggestions would be > appreciated. Have you looked at your log/test.log file to see if there are any exceptions being thrown? Or at least to see what is being rendered, perhaps you’re hitting a path you don’t intend. – Zach D. [http://www.continuousthinking.com](http://www.continuousthinking.com) > **[Homepage | Mutually Human](https://www.mutuallyhuman.com/)** > > Technology Made for Humans by humans Data Analytics Data Analytics Data has become a critical part of business for most organizations. We work with you to ensure you have confidence in your data, can properly access it, and present it in a way that... ---
**Author:** ![markthomas](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/90db22/32.png) [@markthomas](https://www.ruby-forum.com/u/markthomas)\ **Post date:** [October 7, 2008, 5:32pm UTC](https://www.ruby-forum.com/t/post-authentication-token/150301/5 "2008-10-07T17:32:30Z")
Hey thanks Zach. That was a good suggestion. What the log file showed me was that I had a nil object being accessed in my “new” action - and the reason is that it’s an object that in my development code is read from a table of global variables in my db. I create that table, including the values of the global variable, in a migration. However, this doesn’t exist in my test db. So I did a .create in my “given” step to instantiate the global variable and I’m now all good. Mark. ---
**Author:** ![markthomas](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/90db22/32.png) [@markthomas](https://www.ruby-forum.com/u/markthomas)\ **Post date:** [October 7, 2008, 3:21pm UTC](https://www.ruby-forum.com/t/post-authentication-token/150301/6 "2008-10-07T15:21:38Z")
Another tip is to use script/console and walk the app manually. In script/console you get an app object which is the context that your story steps / integration tests run in. e.g. $script/console Loading rails blah blah blah > > app.post “/login”, :username =\> “matt”, :password =\> “secret” > > puts app.response.body > > app.visits “/hello” etc. Often quite handy for having an explore when you can’t figure out how to drive something from a test. ---
**Author:** ![markthomas](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/90db22/32.png) [@markthomas](https://www.ruby-forum.com/u/markthomas)\ **Post date:** [October 7, 2008, 8:26pm UTC](https://www.ruby-forum.com/t/post-authentication-token/150301/7 "2008-10-07T20:26:02Z")
You may want to look into using seed data. I currently use seed\_fu by mbleigh: [GitHub - mbleigh/seed-fu: Advanced seed data handling for Rails, combining the best practices of several methods together.](http://github.com/mbleigh/seed-fu/tree/master) Here’s the snippet I use to load them: ActiveRecord::Base.establish\_connection(ActiveRecord::Base.configurations[‘test’]) ActiveRecord::Schema.verbose = false load “#{RAILS\_ROOT}/db/schema.rb” Dir[File.join(RAILS\_ROOT, “features/fixtures”, ‘\*.rb’)].sort.each { |fixture| load fixture } I do this rather than a rake task because that takes forever (thx Brandon K. for correcting my usage, you have saved me tons of minutes) Zach On Tue, Oct 7, 2008 at 11:23 AM, Mark T. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > > > Rails button\_to call. I tried installing webrat and put "visits ‘/’ " in > > > And I see here - > > > exceptions being thrown? Or at least to see what is being rendered, > > > perhaps you’re hitting a path you don’t intend. > > * * * > > rspec-users mailing list > removed\_email\_address@domain.invalid > [http://rubyforge.org/mailman/listinfo/rspec-users](http://rubyforge.org/mailman/listinfo/rspec-users) – Zach D. [http://www.continuousthinking.com](http://www.continuousthinking.com) > **[Homepage | Mutually Human](https://www.mutuallyhuman.com/)** > > Technology Made for Humans by humans Data Analytics Data Analytics Data has become a critical part of business for most organizations. We work with you to ensure you have confidence in your data, can properly access it, and present it in a way that... ---
**Author:** ![markthomas](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/90db22/32.png) [@markthomas](https://www.ruby-forum.com/u/markthomas)\ **Post date:** [October 7, 2008, 8:45pm UTC](https://www.ruby-forum.com/t/post-authentication-token/150301/8 "2008-10-07T20:45:59Z")
Nice. Thanks. I had wondered if there was a way to separate the data initialization from the step definitions. Looks like that’s what this does.