function BasicAuthTest::testBasicAuth

Tests http basic authentication.

File

core/modules/basic_auth/tests/src/Functional/BasicAuthTest.php, line 42

Class

BasicAuthTest

Tests for BasicAuth authentication provider.

Namespace

Code

public function testBasicAuth() : void {
  // Enable page caching.
  $config = $this->config('system.performance');
  $config->set('cache.page.max_age', 300);
  $config->save();
  $account = $this->drupalCreateUser();
  $url = Url::fromRoute('router_test.11');
  // Ensure we can log in with valid authentication details.
  $this->basicAuthGet($url, $account->getAccountName(), $account->pass_raw);
  $this->assertSession()
    ->pageTextContains($account->getAccountName());
  $this->assertSession()
    ->statusCodeEquals(200);
  $this->mink
    ->resetSessions();
  $this->assertSession()
    ->responseHeaderDoesNotExist('X-Drupal-Cache');
  // Check that Cache-Control is not set to public.
  $this->assertSession()
    ->responseHeaderNotContains('Cache-Control', 'public');
  // Ensure that invalid authentication details give access denied.
  $this->basicAuthGet($url, $account->getAccountName(), $this->randomMachineName());
  $this->assertSession()
    ->pageTextNotContains($account->getAccountName());
  $this->assertSession()
    ->statusCodeEquals(403);
  $this->mink
    ->resetSessions();
  // Ensure that the user is prompted to authenticate if they are not yet
  // authenticated and the route only allows basic auth.
  $this->drupalGet($url);
  $this->assertSession()
    ->responseHeaderEquals('WWW-Authenticate', 'Basic realm="' . \Drupal::config('system.site')->get('name') . '"');
  $this->assertSession()
    ->statusCodeEquals(401);
  // Ensure that a route without basic auth defined doesn't prompt for auth.
  $this->drupalGet('admin');
  $this->assertSession()
    ->statusCodeEquals(403);
  $account = $this->drupalCreateUser([
    'access administration pages',
  ]);
  // Ensure that a route without basic auth defined doesn't allow login.
  $this->basicAuthGet(Url::fromRoute('system.admin'), $account->getAccountName(), $account->pass_raw);
  $this->assertSession()
    ->linkNotExists('Log out', 'User is not logged in');
  $this->assertSession()
    ->statusCodeEquals(403);
  $this->mink
    ->resetSessions();
  // Ensure that pages already in the page cache aren't returned from page
  // cache if basic auth credentials are provided.
  $url = Url::fromRoute('router_test.10');
  $this->drupalGet($url);
  $this->assertSession()
    ->responseHeaderEquals('X-Drupal-Cache', 'MISS');
  $this->basicAuthGet($url, $account->getAccountName(), $account->pass_raw);
  $this->assertSession()
    ->responseHeaderDoesNotExist('X-Drupal-Cache');
  // Check that Cache-Control is not set to public.
  $this->assertSession()
    ->responseHeaderNotContains('Cache-Control', 'public');
}