Using Basic HTTP access authentication in Django testing framework

Question

For some of my Django views I've created a decorator that performs Basic HTTP access authentication. However, while writing test cases in Django, it took me a while to work out how to authenticate to the view. Here's how I did it. I hope somebody finds this useful.

Detta

Answer 1

Here's how I did it:

from django.test import Client
import base64
auth_headers = {
    'HTTP_AUTHORIZATION': 'Basic ' + base64.b64encode('username:password'),
}
c = Client()
response = c.get('/my-protected-url/', **auth_headers)

Note: You will also need to create a user.

Detta

If you are manipulation unicode strings (typical eg: using py3) you'd need to do something like base64.b64encode('username:password'.encode()).decode() because base64 module do not handle unicode strings. – Helper

@Jocelyndelalande more like base64.b64encode(bytes('username:password', 'utf8')).decode('utf8'), – Parenteau

@vyscond up to your taste, because it's strictly the same processing. – Helper

Great answer! Just complementing: Using python 3.5 I just made c.get('/my-protected-url/', HTTP_AUTHORIZATION='Basic username:password') as shown in django docs and CGI docs. – Cavern

Why HTTP_AUTHORIZATION and not Authorization ? – Ledger

@DanielGomezRico: Confusing, indeed. A bit late, but there's an explanation to be found in https://mcmap.net/q/324055/-django-tokenauthentication-missing-the-39-authorization-39-http-header – Guesswork

The process for creating a valid Basic auth header, including the Base64 encoding, is described in RFC7617. – Guesswork

Same structure will work for token authorization also, just replace basic with Token – Respiration

Answer 2

In your Django TestCase you can update the client defaults to contain your HTTP basic auth credentials.

import base64
from django.test import TestCase

class TestMyStuff(TestCase):

    def setUp(self):
        credentials = base64.b64encode('username:password')
        self.client.defaults['HTTP_AUTHORIZATION'] = 'Basic ' + credentials

Historic

This can also be done a bit more succinctly using the credentials() method of the Client object: self.client.credentials(HTTP_AUTHORIZATION='Basic ' + credentials) (cf. django-rest-framework.org/api-guide/testing/#credentialskwargs). – Dry

@KurtPeek that only works with django-rest-framework, not with the vanilla Django test client – Drippy

Answer 3

For python3, you can base64-encode your username:password string:

base64.b64encode(b'username:password')

This returns bytes, so you need to transfer it into an ASCII string with .decode('ascii'):

Complete example:

import base64

from django.test import TestCase

class TestClass(TestCase):
   def test_authorized(self):
       headers = {
           'HTTP_AUTHORIZATION': 'Basic ' + 
                base64.b64encode(b'username:password').decode("ascii")
       }
       response = self.client.get('/', **headers)
       self.assertEqual(response.status_code, 200)

Frailty

Thanks for the answer. It's so helpful . – Boulware

Answer 4

Assuming I have a login form, I use the following technique to login through the test framework:

    client = Client()
    client.post('/login/', {'username': 'john.smith', 'password': 'secret'})

I then carry the client around in my other tests since it's already authenticated. What is your question to this post?

Kerenkeresan

Yeah, that's a nice solution Thierry. Although it does not work for HTTP Authorization as that works by sending the login creditials as HTTP headers. I'm doing it this way because the view is an API call rather than a regular view. – Detta

This is the only solution that worked for me (for browser views). Even more straightforward: Django client login method – Radiosensitive

Answer 5

(python3) I'm using this in a test:

credentials_string = '%s:%s' % ('invalid', 'invalid')
credentials = base64.b64encode(credentials_string.encode())
self.client.defaults['HTTP_AUTHORIZATION'] = 'Basic ' + credentials.decode()

and the following in a view:

import base64
[...]
type, auth = request.META['HTTP_AUTHORIZATION'].split(' ', 1)
auth = base64.b64decode(auth.strip()).decode()

Lionhearted

Answer 6

Another way to do it is to bypass the Django Client() and use Requests instead.

class MyTest(TestCase):
    def setUp(self):
        AUTH = requests.auth.HTTPBasicAuth("username", "password")

    def some_test(self):
        resp = requests.get(BASE_URL + 'endpoint/', auth=AUTH)
        self.assertEqual(resp.status_code, 200)

Text

the response class from requests is not guaranteed to be 100% compatible with the one that django uses. For example, you won't have response.context available. – Druse

This makes an actual http request across the network. This is almost never what you want to do in a unit test. – Bostic