1 files changed, 28 insertions, 8 deletions
diff --git a/actionpack/test/controller/http_digest_authentication_test.rb b/actionpack/test/controller/http_digest_authentication_test.rb
index 00789eea38..15a11395bb 100644
--- a/actionpack/test/controller/http_digest_authentication_test.rb
+++ b/actionpack/test/controller/http_digest_authentication_test.rb
@@ -38,6 +38,15 @@ class HttpDigestAuthenticationTest < ActionController::TestCase
 
   tests DummyDigestController
 
+  setup do
+    # Used as secret in generating nonce to prevent tampering of timestamp
+    @old_secret, ActionController::Base.session_options[:secret] = ActionController::Base.session_options[:secret], "session_options_secret"
+  end
+
+  teardown do
+    ActionController::Base.session_options[:secret] = @old_secret
+  end
+
   AUTH_HEADERS.each do |header|
     test "successful authentication with #{header.downcase}" do
       @request.env[header] = encode_credentials(:username => 'lifo', :password => 'world')
@@ -111,8 +120,6 @@ class HttpDigestAuthenticationTest < ActionController::TestCase
   test "authentication request with valid credential and nil session" do
     @request.env['HTTP_AUTHORIZATION'] = encode_credentials(:username => 'pretty', :password => 'please')
 
-    # session_id = "" in functional test, but is +nil+ in real life
-    @request.session.session_id = nil
     get :display
 
     assert_response :success
@@ -151,25 +158,38 @@ class HttpDigestAuthenticationTest < ActionController::TestCase
     assert_equal 'Definitely Maybe', @response.body
   end
 
+  test "authentication request with _method" do
+    @request.env['HTTP_AUTHORIZATION'] = encode_credentials(:username => 'pretty', :password => 'please', :method => :post)
+    @request.env['rack.methodoverride.original_method'] = 'POST'
+    put :display
+
+    assert_response :success
+    assert assigns(:logged_in)
+    assert_equal 'Definitely Maybe', @response.body
+  end
+
   private
 
   def encode_credentials(options)
     options.reverse_merge!(:nc => "00000001", :cnonce => "0a4f113b", :password_is_ha1 => false)
     password = options.delete(:password)
 
-    # Set in /initializers/session_store.rb. Used as secret in generating nonce
-    # to prevent tampering of timestamp
-    ActionController::Base.session_options[:secret] = "session_options_secret"
+    # Perform unauthenticated request to retrieve digest parameters to use on subsequent request
+    method = options.delete(:method) || 'GET'
 
-    # Perform unauthenticated GET to retrieve digest parameters to use on subsequent request
-    get :index
+    case method.to_s.upcase
+    when 'GET'
+      get :index
+    when 'POST'
+      post :index
+    end
 
     assert_response :unauthorized
 
     credentials = decode_credentials(@response.headers['WWW-Authenticate'])
     credentials.merge!(options)
     credentials.reverse_merge!(:uri => "#{@request.env['REQUEST_URI']}")
-    ActionController::HttpAuthentication::Digest.encode_credentials("GET", credentials, password, options[:password_is_ha1])
+    ActionController::HttpAuthentication::Digest.encode_credentials(method, credentials, password, options[:password_is_ha1])
   end
 
   def decode_credentials(header)