For some of my Django views I've created a decorator that performs Basic HTTP access authentication. However, while writing test cases in Django, it took me a while to work out how to authenticate to the view. Here's how I did it. I hope somebody finds this useful.
Add a comment
|
6 Answers
Here's how I did it:
from django.test import Client
import base64
auth_headers = {
'HTTP_AUTHORIZATION': 'Basic ' + base64.b64encode('username:password'),
}
c = Client()
response = c.get('/my-protected-url/', **auth_headers)
Note: You will also need to create a user.
8 Comments
Jocelyn delalande
If you are manipulation unicode strings (typical eg: using py3) you'd need to do something like
base64.b64encode('username:password'.encode()).decode() because base64 module do not handle unicode strings.
Moraes
@Jocelyndelalande more like
base64.b64encode(bytes('username:password', 'utf8')).decode('utf8'),
lucastamoios
Great answer! Just complementing: Using python 3.5 I just made
c.get('/my-protected-url/', HTTP_AUTHORIZATION='Basic username:password') as shown in django docs and CGI docs.
Daniel Gomez Rico
Why HTTP_AUTHORIZATION and not Authorization ?
djvg
@DanielGomezRico: Confusing, indeed. A bit late, but there's an explanation to be found in stackoverflow.com/q/15113248
|
In your Django TestCase you can update the client defaults to contain your HTTP basic auth credentials.
import base64
from django.test import TestCase
class TestMyStuff(TestCase):
def setUp(self):
credentials = base64.b64encode('username:password')
self.client.defaults['HTTP_AUTHORIZATION'] = 'Basic ' + credentials
2 Comments
Kurt Peek
This can also be done a bit more succinctly using the
credentials() method of the Client object: self.client.credentials(HTTP_AUTHORIZATION='Basic ' + credentials) (cf. django-rest-framework.org/api-guide/testing/#credentialskwargs).
Salvioner
@KurtPeek that only works with django-rest-framework, not with the vanilla Django test client
For python3, you can base64-encode your username:password string:
base64.b64encode(b'username:password')
This returns bytes, so you need to transfer it into an ASCII string with .decode('ascii'):
Complete example:
import base64
from django.test import TestCase
class TestClass(TestCase):
def test_authorized(self):
headers = {
'HTTP_AUTHORIZATION': 'Basic ' +
base64.b64encode(b'username:password').decode("ascii")
}
response = self.client.get('/', **headers)
self.assertEqual(response.status_code, 200)
Comments
Assuming I have a login form, I use the following technique to login through the test framework:
client = Client()
client.post('/login/', {'username': 'john.smith', 'password': 'secret'})
I then carry the client around in my other tests since it's already authenticated. What is your question to this post?
2 Comments
Humphrey
Yeah, that's a nice solution Thierry. Although it does not work for HTTP Authorization as that works by sending the login creditials as HTTP headers. I'm doing it this way because the view is an API call rather than a regular view.
Beolap
This is the only solution that worked for me (for browser views). Even more straightforward: Django client login method
(python3) I'm using this in a test:
credentials_string = '%s:%s' % ('invalid', 'invalid')
credentials = base64.b64encode(credentials_string.encode())
self.client.defaults['HTTP_AUTHORIZATION'] = 'Basic ' + credentials.decode()
and the following in a view:
import base64
[...]
type, auth = request.META['HTTP_AUTHORIZATION'].split(' ', 1)
auth = base64.b64decode(auth.strip()).decode()
Comments
Another way to do it is to bypass the Django Client() and use Requests instead.
class MyTest(TestCase):
def setUp(self):
AUTH = requests.auth.HTTPBasicAuth("username", "password")
def some_test(self):
resp = requests.get(BASE_URL + 'endpoint/', auth=AUTH)
self.assertEqual(resp.status_code, 200)
2 Comments
fcurella
the response class from
requests is not guaranteed to be 100% compatible with the one that django uses. For example, you won't have response.context available.
slinkp
This makes an actual http request across the network. This is almost never what you want to do in a unit test.