# Testing HTTP Basic Authentication

**URL:** <https://discuss.rubyonrails.org/t/testing-http-basic-authentication/22184>\
**Category:** rubyonrails-talk\
**Created:** [December 24, 2007, 2:36am UTC](https://discuss.rubyonrails.org/t/testing-http-basic-authentication/22184 "2007-12-24T02:36:59Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![richard](https://avatars.discourse-cdn.com/v4/letter/r/f0a364/32.png) [@richard](https://discuss.rubyonrails.org/u/richard)\
**Post date:** [December 24, 2007, 2:36am UTC](https://discuss.rubyonrails.org/t/testing-http-basic-authentication/22184/1 "2007-12-24T02:36:59Z")

</div>

I'm using the new 2.0 HTTP Basic Authentication module mentioned in the announcement, and having trouble figuring out how to write a functional tests that will do both positive and negative tests.

The framework documentation has the following snippet:

\<\<BEGIN SNIPPET\>\> In your integration tests, you can do something like this:

&nbsp;&nbsp;def test\_access\_granted\_from\_xml &nbsp;&nbsp;&nbsp;&nbsp;get( &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"/notes/1.xml", nil, &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;:authorization =\> ActionController::HttpAuthentication::Basic.encode\_credentials(users(:dhh).name, users(:dhh).password) &nbsp;&nbsp;&nbsp;&nbsp;)

&nbsp;&nbsp;&nbsp;&nbsp;assert\_equal 200, status &nbsp;&nbsp;end \<\<END SNIPPET\>\>

Looking at the code for the test\_process implementation of get, the parameters are: action, parameters = nil, session = nil, flash = nil.

That :authorization hash would actually be part of the session, not the headers. I looked around and couldn't figure out how to set headers in a test context.

I'd like to add tests to make sure that those sections that require authentication are guarded and that entering the wrong account/ password fails.

Any suggestions?

---

<div class="post-metadata">

**Author:** ![Bala\_Paranj](https://avatars.discourse-cdn.com/v4/letter/b/41988e/32.png) [@Bala\_Paranj](https://discuss.rubyonrails.org/u/Bala_Paranj)\
**Post date:** [December 24, 2007, 7:07am UTC](https://discuss.rubyonrails.org/t/testing-http-basic-authentication/22184/2 "2007-12-24T07:07:30Z")

</div>

Here is the testing code:

class Admin::EventsControllerTest \< Test::Unit::TestCase fixtures :categories

def setup @controller = Admin::EventsController.new @request = ActionController:: TestRequest.new @response = ActionController::TestResponse.new end

def login\_as\_admin @request.env[‘HTTP\_AUTHORIZATION’] = ActionController::HttpAuthentication::Basic.encode\_credentials (“admin”, “password”) end

def test\_all\_pages\_for\_admin\_is\_protected [:index, :edit, :show, :create, :update, :destroy].each do |actione| get actione assert\_response :unauthorized

```
end

```

end

def test\_index\_page\_loads\_upon\_successful\_login login\_as\_admin

```
get :index, :id => categories(:all).id

assert_response :success
assert_template 'index'

assert assigns(:events)

```

end end

---

<div class="post-metadata">

**Author:** ![richard](https://avatars.discourse-cdn.com/v4/letter/r/f0a364/32.png) [@richard](https://discuss.rubyonrails.org/u/richard)\
**Post date:** [December 24, 2007, 7:46am UTC](https://discuss.rubyonrails.org/t/testing-http-basic-authentication/22184/3 "2007-12-24T07:46:45Z")

</div>

Ahh, that makes sense.

The key part being:

&nbsp;&nbsp;@request.env['HTTP\_AUTHORIZATION'] = ActionController::HttpAuthentication::Basic.encode\_credentials("admin", "password")

Thanks!