How do you unit test web page authorization using ASP.NET MVC?

Question

Let's say you have a profile page that can only be accessed by the owner of that profile. This profile page is located at:

User/Profile/{userID}

Now, I imagine in order to prevent access to this page by other users, you could structure your UserController class's Profile function to check the current session's identity:

HttpContext.Current.User.Identity.Name

If the id matches the one in the url, then you proceed. Otherwise you redirect to some sort of error page.

My question is how do you unit test something like this? I'm guessing that you need to use some sort of dependency injection instead of the HttpContext in the controller to do the check on, but I am unclear what the best way to do that is. Any advice would be helpful.

Brian Vallelunga · Accepted Answer · 2008-10-01 14:43:10Z

1

The link above is a good one. I would also add that instead of programmatically checking the User.Identity.Name value, you should use the Authorize attributes as outlined in the article:

http://weblogs.asp.net/scottgu/archive/2008/07/14/asp-net-mvc-preview-4-release-part-1.aspx

answered Oct 1, 2008 at 14:43

Brian Vallelunga

10.2k16 gold badges65 silver badges93 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Kevin Pang · Accepted Answer · 2009-09-01 00:56:11Z

1

I ended up going with the "UserNameFilter" shown in Kazi Manzur's blog post. Works like a charm and easy to unit test.

answered Sep 1, 2009 at 0:56

Kevin Pang

41.5k38 gold badges123 silver badges173 bronze badges

Comments

Roger Lipscombe · Accepted Answer · 2010-04-22 09:47:45Z

1

You can probably do it by using a fake for the controller context. Check out this article: http://stephenwalther.com/blog/archive/2008/07/01/asp-net-mvc-tip-12-faking-the-controller-context.aspx

edited Apr 22, 2010 at 9:47

Roger Lipscombe

92.5k59 gold badges255 silver badges402 bronze badges

answered Sep 25, 2008 at 10:51

aogan

2,2811 gold badge15 silver badges24 bronze badges

Comments

jeef3 · Accepted Answer · 2009-09-01 01:05:07Z

0

This is where mocking comes in, with a fake HttpContext.

answered Sep 1, 2009 at 1:05

jeef3

2,0072 gold badges18 silver badges22 bronze badges

Collectives™ on Stack Overflow

How do you unit test web page authorization using ASP.NET MVC?

4 Answers 4

Comments

Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

Comments

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related