# Testing HTTP Basic Authentication

**URL:** <https://www.ruby-forum.com/t/testing-http-basic-authentication/124052>\
**Category:** Rails\
**Created:** [December 24, 2007, 3:37am UTC](https://www.ruby-forum.com/t/testing-http-basic-authentication/124052 "2007-12-24T03:37:15Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\
**Post date:** [December 24, 2007, 3:37am UTC](https://www.ruby-forum.com/t/testing-http-basic-authentication/124052/1 "2007-12-24T03:37:15Z")

</div>

I’m using the new 2.0 HTTP Basic Authentication module mentioned in  
the announcement, and having trouble figuring out how to write a  
functional tests that will do both positive and negative tests.

The framework documentation has the following snippet:

\<\>  
In your integration tests, you can do something like this:

def test\_access\_granted\_from\_xml  
get(  
“/notes/1.xml”, nil,  
:authorization =\>  
ActionController::HttpAuthentication::Basic.encode\_credentials(users(:dhh).name,  
users(:dhh).password)  
)

```
assert_equal 200, status

```

end  
\<\>

Looking at the code for the test\_process implementation of get, the  
parameters are: action, parameters = nil, session = nil, flash = nil.

That :authorization hash would actually be part of the session, not  
the headers. I looked around and couldn’t figure out how to set  
headers in a test context.

I’d like to add tests to make sure that those sections that require  
authentication are guarded and that entering the wrong account/  
password fails.

Any suggestions?

---

<div class="post-metadata">

**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\
**Post date:** [December 24, 2007, 8:07am UTC](https://www.ruby-forum.com/t/testing-http-basic-authentication/124052/2 "2007-12-24T08:07:49Z")

</div>

Here is the testing code:

class Admin::EventsControllerTest \< Test::Unit::TestCase  
fixtures :categories

def setup  
@controller = Admin::EventsController.new  
@request = ActionController::TestRequest.new  
@response = ActionController::TestResponse.new  
end

def login\_as\_admin  
@request.env[‘HTTP\_AUTHORIZATION’] =  
ActionController::HttpAuthentication::Basic.encode\_credentials(“admin”,  
“password”)  
end

def test\_all\_pages\_for\_admin\_is\_protected  
[:index, :edit, :show, :create, :update, :destroy].each do |actione|  
get actione  
assert\_response :unauthorized  
end  
end

def test\_index\_page\_loads\_upon\_successful\_login  
login\_as\_admin

```
get :index, :id => categories(:all).id

assert_response :success
assert_template 'index'
assert assigns(:events)

```

end  
end

On Dec 23, 2007 6:36 PM, removed\_email\_address@domain.invalid [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)  
wrote:

> I’m using the new 2.0 HTTP Basic Authentication module mentioned in  
> the announcement, and having trouble figuring out how to write a  
> functional tests that will do both positive and negative tests.

–  
[http://www.rubyplus.org/](http://www.rubyplus.org/)  
Free Ruby Screencasts

---

<div class="post-metadata">

**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\
**Post date:** [December 24, 2007, 8:47am UTC](https://www.ruby-forum.com/t/testing-http-basic-authentication/124052/3 "2007-12-24T08:47:33Z")

</div>

Ahh, that makes sense.

The key part being:

@request.env[‘HTTP\_AUTHORIZATION’] =  
ActionController::HttpAuthentication::Basic.encode\_credentials(“admin”,  
“password”)

Thanks!