One of the trickiest, and yet most important, areas of testing web sites is the security. Testing these schemes is one of the core goals of the SimpleTest web tester.

Basic HTTP authentication

If you fetch a page protected by basic authentication then rather than receiving content, you will instead get a 401 header. We can illustrate this with this test...

class AuthenticationTest extends WebTestCase {
    function test401Header() {
        $this->get('http://www.lastcraft.com/protected/');
        $this->showHeaders();
    }
}

HTTP/1.1 401 Authorization Required
Date: Sat, 18 Sep 2004 19:25:18 GMT
Server: Apache/1.3.29 (Unix) PHP/4.3.4
WWW-Authenticate: Basic realm="SimpleTest basic authentication"
Connection: close
Content-Type: text/html; charset=iso-8859-1

class AuthenticationTest extends WebTestCase {
    function test401Header() {
        $this->get('http://www.lastcraft.com/protected/');
        $this->assertAuthentication('Basic');
        $this->assertResponse(401);
        $this->assertRealm('SimpleTest basic authentication');
    }
}

One theme that runs through SimpleTest is the ability to use SimpleExpectation objects wherever a simple match is not enough. If you want only an approximate match to the realm for example, you can do this...

class AuthenticationTest extends WebTestCase {
    function test401Header() {
        $this->get('http://www.lastcraft.com/protected/');
        $this->assertRealm(new PatternExpectation('/simpletest/i'));
    }
}

Most of the time we are not interested in testing the authentication itself, but want to get past it to test the pages underneath. As soon as the challenge has been issued we can reply with an authentication response...

class AuthenticationTest extends WebTestCase {
    function testCanAuthenticate() {
        $this->get('http://www.lastcraft.com/protected/');
        $this->authenticate('Me', 'Secret');
        $this->assertTitle(...);
    }
}

If you want, you can shortcut this step further by encoding the log in details straight into the URL...

class AuthenticationTest extends WebTestCase {
    function testCanReadAuthenticatedPages() {
        $this->get('http://Me:Secret@www.lastcraft.com/protected/');
        $this->assertTitle(...);
    }
}

A problem with encoding the login details directly in the URL is the authentication header will not be sent on subsequent requests. If you navigate with relative URLs though, the authentication information will be preserved along with the domain name.

Normally though, you use the authenticate() call. SimpleTest will then remember your login information on each request.

Only testing with basic authentication is currently supported, and this is only really secure in tandem with HTTPS connections. This is usually good enough to protect test server from prying eyes, however. Digest authentication and NTLM authentication may be added in the future if enough people request this feature.

Cookies

Basic authentication doesn't give enough control over the user interface for web developers. More likely this functionality will be coded directly into the web architecture using cookies with complicated timeouts. We need to be able to test this too.

Starting with a simple log-in form...

<form>
    Username:
    <input type="text" name="u" value="" /><br />
    Password:
    <input type="password" name="p" value="" /><br />
    <input type="submit" value="Log in" />
</form>

Let's suppose that in fetching this page a cookie has been set with a session ID. We are not going to fill the form in yet, just test that we are tracking the user. Here is the test...

class LogInTest extends WebTestCase {
    function testSessionCookieSetBeforeForm() {
        $this->get('http://www.my-site.com/login.php');
        $this->assertCookie('SID');
    }
}

class LogInTest extends WebTestCase {
    function testSessionCookieIsCorrectPattern() {
        $this->get('http://www.my-site.com/login.php');
        $this->assertCookie('SID', new PatternExpectation('/[a-f0-9]{32}/i'));
    }
}

The simplest test of logging in is to visually inspect the next page to see if you are really logged in. Just test the next page with WebTestCase::assertText().

The test is similar to any other form test, but we might want to confirm that we still have the same cookie after log-in as before we entered. We wouldn't want to lose track of this after all. Here is a possible test for this...

class LogInTest extends WebTestCase {
    ...
    function testSessionCookieSameAfterLogIn() {
        $this->get('http://www.my-site.com/login.php');
        $session = $this->getCookie('SID');
        $this->setField('u', 'Me');
        $this->setField('p', 'Secret');
        $this->click('Log in');
        $this->assertText('Welcome Me');
        $this->assertCookie('SID', $session);
    }
}

We could even attempt to hack our own system by setting arbitrary cookies to gain access...

class LogInTest extends WebTestCase {
    ...
    function testSessionCookieSameAfterLogIn() {
        $this->get('http://www.my-site.com/login.php');
        $this->setCookie('SID', 'Some other session');
        $this->get('http://www.my-site.com/restricted.php');
        $this->assertText('Access denied');
    }
}

Browser sessions

If you are testing an authentication system a critical piece of behaviour is what happens when a user logs back in. We would like to simulate closing and reopening a browser...

class LogInTest extends WebTestCase {
    ...
    function testLoseAuthenticationAfterBrowserClose() {
        $this->get('http://www.my-site.com/login.php');
        $this->setField('u', 'Me');
        $this->setField('p', 'Secret');
        $this->click('Log in');
        $this->assertText('Welcome Me');
        
        $this->restart();
        $this->get('http://www.my-site.com/restricted.php');
        $this->assertText('Access denied');
    }
}

Expiring cookies can be a problem. After all, if you have a cookie that expires after an hour, you don't want to stall the test for an hour while waiting for the cookie to pass it's timeout.

To push the cookies over the hour limit you can age them before you restart the session...

class LogInTest extends WebTestCase {
    ...
    function testLoseAuthenticationAfterOneHour() {
        $this->get('http://www.my-site.com/login.php');
        $this->setField('u', 'Me');
        $this->setField('p', 'Secret');
        $this->click('Log in');
        $this->assertText('Welcome Me');
        
        $this->ageCookies(3600);
        $this->restart();
        $this->get('http://www.my-site.com/restricted.php');
        $this->assertText('Access denied');
    }
}