From 04949096797a390105c7ab9fb9b99938d5921dd4 Mon Sep 17 00:00:00 2001 From: Joshua Peek Date: Sun, 26 Apr 2009 14:33:57 -0500 Subject: Inherit TestSession from Session::AbstractStore and add indifferent access to Session::AbstractStore. --- actionpack/test/controller/http_digest_authentication_test.rb | 2 -- 1 file changed, 2 deletions(-) (limited to 'actionpack/test/controller/http_digest_authentication_test.rb') diff --git a/actionpack/test/controller/http_digest_authentication_test.rb b/actionpack/test/controller/http_digest_authentication_test.rb index 00789eea38..7bebc8cd2a 100644 --- a/actionpack/test/controller/http_digest_authentication_test.rb +++ b/actionpack/test/controller/http_digest_authentication_test.rb @@ -111,8 +111,6 @@ class HttpDigestAuthenticationTest < ActionController::TestCase test "authentication request with valid credential and nil session" do @request.env['HTTP_AUTHORIZATION'] = encode_credentials(:username => 'pretty', :password => 'please') - # session_id = "" in functional test, but is +nil+ in real life - @request.session.session_id = nil get :display assert_response :success -- cgit v1.2.3 From 195fadbfd31294d43634afb7bbf4f0ffc86b470a Mon Sep 17 00:00:00 2001 From: Pratik Naik Date: Mon, 18 May 2009 16:59:37 +0200 Subject: Ensure HTTP Digest auth uses appropriate HTTP method [#2490 state:resolved] [Steve Madsen] --- .../controller/http_digest_authentication_test.rb | 23 +++++++++++++++++++--- 1 file changed, 20 insertions(+), 3 deletions(-) (limited to 'actionpack/test/controller/http_digest_authentication_test.rb') diff --git a/actionpack/test/controller/http_digest_authentication_test.rb b/actionpack/test/controller/http_digest_authentication_test.rb index 7bebc8cd2a..b8a2205ce6 100644 --- a/actionpack/test/controller/http_digest_authentication_test.rb +++ b/actionpack/test/controller/http_digest_authentication_test.rb @@ -149,6 +149,16 @@ class HttpDigestAuthenticationTest < ActionController::TestCase assert_equal 'Definitely Maybe', @response.body end + test "authentication request with _method" do + @request.env['HTTP_AUTHORIZATION'] = encode_credentials(:username => 'pretty', :password => 'please', :method => :post) + @request.env['rack.methodoverride.original_method'] = 'POST' + put :display + + assert_response :success + assert assigns(:logged_in) + assert_equal 'Definitely Maybe', @response.body + end + private def encode_credentials(options) @@ -159,15 +169,22 @@ class HttpDigestAuthenticationTest < ActionController::TestCase # to prevent tampering of timestamp ActionController::Base.session_options[:secret] = "session_options_secret" - # Perform unauthenticated GET to retrieve digest parameters to use on subsequent request - get :index + # Perform unauthenticated request to retrieve digest parameters to use on subsequent request + method = options.delete(:method) || 'GET' + + case method.to_s.upcase + when 'GET' + get :index + when 'POST' + post :index + end assert_response :unauthorized credentials = decode_credentials(@response.headers['WWW-Authenticate']) credentials.merge!(options) credentials.reverse_merge!(:uri => "#{@request.env['REQUEST_URI']}") - ActionController::HttpAuthentication::Digest.encode_credentials("GET", credentials, password, options[:password_is_ha1]) + ActionController::HttpAuthentication::Digest.encode_credentials(method, credentials, password, options[:password_is_ha1]) end def decode_credentials(header) -- cgit v1.2.3 From 1a52b246eb245d159a1c331417a4b14923e9bc4e Mon Sep 17 00:00:00 2001 From: Pratik Naik Date: Fri, 22 May 2009 00:26:58 +0200 Subject: Add HTTP Authentication to the new base --- .../test/controller/http_digest_authentication_test.rb | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) (limited to 'actionpack/test/controller/http_digest_authentication_test.rb') diff --git a/actionpack/test/controller/http_digest_authentication_test.rb b/actionpack/test/controller/http_digest_authentication_test.rb index b8a2205ce6..15a11395bb 100644 --- a/actionpack/test/controller/http_digest_authentication_test.rb +++ b/actionpack/test/controller/http_digest_authentication_test.rb @@ -38,6 +38,15 @@ class HttpDigestAuthenticationTest < ActionController::TestCase tests DummyDigestController + setup do + # Used as secret in generating nonce to prevent tampering of timestamp + @old_secret, ActionController::Base.session_options[:secret] = ActionController::Base.session_options[:secret], "session_options_secret" + end + + teardown do + ActionController::Base.session_options[:secret] = @old_secret + end + AUTH_HEADERS.each do |header| test "successful authentication with #{header.downcase}" do @request.env[header] = encode_credentials(:username => 'lifo', :password => 'world') @@ -165,10 +174,6 @@ class HttpDigestAuthenticationTest < ActionController::TestCase options.reverse_merge!(:nc => "00000001", :cnonce => "0a4f113b", :password_is_ha1 => false) password = options.delete(:password) - # Set in /initializers/session_store.rb. Used as secret in generating nonce - # to prevent tampering of timestamp - ActionController::Base.session_options[:secret] = "session_options_secret" - # Perform unauthenticated request to retrieve digest parameters to use on subsequent request method = options.delete(:method) || 'GET' -- cgit v1.2.3