| [ Index ] |
|
Code source de PRADO 3.0.6 |
1 <html> 2 <head> 3 <META http-equiv="Content-Type" content="text/html; charset=UTF-8"> 4 <title>SimpleTest documentation for testing log-in and authentication</title> 5 <link rel="stylesheet" type="text/css" href="docs.css" title="Styles"> 6 </head> 7 <body> 8 <div class="menu_back"> 9 <div class="menu"> 10 <h2> 11 <a href="index.html">SimpleTest</a> 12 </h2> 13 <ul> 14 <li> 15 <a href="overview.html">Overview</a> 16 </li> 17 <li> 18 <a href="unit_test_documentation.html">Unit tester</a> 19 </li> 20 <li> 21 <a href="group_test_documentation.html">Group tests</a> 22 </li> 23 <li> 24 <a href="mock_objects_documentation.html">Mock objects</a> 25 </li> 26 <li> 27 <a href="partial_mocks_documentation.html">Partial mocks</a> 28 </li> 29 <li> 30 <a href="reporter_documentation.html">Reporting</a> 31 </li> 32 <li> 33 <a href="expectation_documentation.html">Expectations</a> 34 </li> 35 <li> 36 <a href="web_tester_documentation.html">Web tester</a> 37 </li> 38 <li> 39 <a href="form_testing_documentation.html">Testing forms</a> 40 </li> 41 <li> 42 <span class="chosen">Authentication</span> 43 </li> 44 <li> 45 <a href="browser_documentation.html">Scriptable browser</a> 46 </li> 47 </ul> 48 </div> 49 </div> 50 <h1>Authentication documentation</h1> 51 <div class="content"> 52 53 <p> 54 One of the trickiest, and yet most important, areas 55 of testing web sites is the security. 56 Testing these schemes is one of the core goals of 57 the SimpleTest web tester. 58 </p> 59 60 <p> 61 <a class="target" name="basic"> 62 <h2>Basic HTTP authentication</h2> 63 </a> 64 </p> 65 <p> 66 If you fetch a page protected by basic authentication then 67 rather than receiving content, you will instead get a 401 68 header. 69 We can illustrate this with this test... 70 <pre> 71 class AuthenticationTest extends WebTestCase {<strong> 72 function test401Header() { 73 $this->get('http://www.lastcraft.com/protected/'); 74 $this->showHeaders(); 75 }</strong> 76 } 77 </pre> 78 This allows us to see the challenge header... 79 <div class="demo"> 80 <h1>File test</h1> 81 <pre style="background-color: lightgray; color: black"> 82 HTTP/1.1 401 Authorization Required 83 Date: Sat, 18 Sep 2004 19:25:18 GMT 84 Server: Apache/1.3.29 (Unix) PHP/4.3.4 85 WWW-Authenticate: Basic realm="SimpleTest basic authentication" 86 Connection: close 87 Content-Type: text/html; charset=iso-8859-1 88 </pre> 89 <div style="padding: 8px; margin-top: 1em; background-color: green; color: white;">1/1 test cases complete. 90 <strong>0</strong> passes, <strong>0</strong> fails and <strong>0</strong> exceptions.</div> 91 </div> 92 We are trying to get away from visual inspection though, and so SimpleTest 93 allows to make automated assertions against the challenge. 94 Here is a thorough test of our header... 95 <pre> 96 class AuthenticationTest extends WebTestCase { 97 function test401Header() { 98 $this->get('http://www.lastcraft.com/protected/');<strong> 99 $this->assertAuthentication('Basic'); 100 $this->assertResponse(401); 101 $this->assertRealm('SimpleTest basic authentication');</strong> 102 } 103 } 104 </pre> 105 Any one of these tests would normally do on it's own depending 106 on the amount of detail you want to see. 107 </p> 108 <p> 109 One theme that runs through SimpleTest is the ability to use 110 <span class="new_code">SimpleExpectation</span> objects wherever a simple 111 match is not enough. 112 If you want only an approximate match to the realm for 113 example, you can do this... 114 <pre> 115 class AuthenticationTest extends WebTestCase { 116 function test401Header() { 117 $this->get('http://www.lastcraft.com/protected/'); 118 $this->assertRealm(<strong>new PatternExpectation('/simpletest/i')</strong>); 119 } 120 } 121 </pre> 122 Most of the time we are not interested in testing the 123 authentication itself, but want to get past it to test 124 the pages underneath. 125 As soon as the challenge has been issued we can reply with 126 an authentication response... 127 <pre> 128 class AuthenticationTest extends WebTestCase { 129 function testCanAuthenticate() { 130 $this->get('http://www.lastcraft.com/protected/');<strong> 131 $this->authenticate('Me', 'Secret');</strong> 132 $this->assertTitle(...); 133 } 134 } 135 </pre> 136 The username and password will now be sent with every 137 subsequent request to that directory and subdirectories. 138 You will have to authenticate again if you step outside 139 the authenticated directory, but SimpleTest is smart enough 140 to merge subdirectories into a common realm. 141 </p> 142 <p> 143 You can shortcut this step further by encoding the log in 144 details straight into the URL... 145 <pre> 146 class AuthenticationTest extends WebTestCase { 147 function testCanReadAuthenticatedPages() { 148 $this->get('http://<strong>Me:Secret@</strong>www.lastcraft.com/protected/'); 149 $this->assertTitle(...); 150 } 151 } 152 </pre> 153 If your username or password has special characters, then you 154 will have to URL encode them or the request will not be parsed 155 correctly. 156 Also this header will not be sent on subsequent requests if 157 you request a page with a fully qualified URL. 158 If you navigate with relative URLs though, the authentication 159 information will be preserved. 160 </p> 161 <p> 162 Only basic authentication is currently supported and this is 163 only really secure in tandem with HTTPS connections. 164 This is usually enough to protect test server from prying eyes, 165 however. 166 Digest authentication and NTLM authentication may be added 167 in the future. 168 </p> 169 170 <p> 171 <a class="target" name="cookies"> 172 <h2>Cookies</h2> 173 </a> 174 </p> 175 <p> 176 Basic authentication doesn't give enough control over the 177 user interface for web developers. 178 More likely this functionality will be coded directly into 179 the web architecture using cookies and complicated timeouts. 180 </p> 181 <p> 182 Starting with a simple log-in form... 183 <pre> 184 <form> 185 Username: 186 <input type="text" name="u" value="" /><br /> 187 Password: 188 <input type="password" name="p" value="" /><br /> 189 <input type="submit" value="Log in" /> 190 </form> 191 </pre> 192 Which looks like... 193 </p> 194 <p> 195 <form class="demo"> 196 Username: 197 <input type="text" name="u" value=""> 198 <br> 199 Password: 200 <input type="password" name="p" value=""> 201 <br> 202 <input type="submit" value="Log in"> 203 </form> 204 </p> 205 <p> 206 Let's suppose that in fetching this page a cookie has been 207 set with a session ID. 208 We are not going to fill the form in yet, just test that 209 we are tracking the user. 210 Here is the test... 211 <pre> 212 class LogInTest extends WebTestCase { 213 function testSessionCookieSetBeforeForm() { 214 $this->get('http://www.my-site.com/login.php');<strong> 215 $this->assertCookie('SID');</strong> 216 } 217 } 218 </pre> 219 All we are doing is confirming that the cookie is set. 220 As the value is likely to be rather cryptic it's not 221 really worth testing this with... 222 <pre> 223 class LogInTest extends WebTestCase { 224 function testSessionCookieIsCorrectPattern() { 225 $this->get('http://www.my-site.com/login.php'); 226 $this->assertCookie('SID', <strong>new PatternExpectation('/[a-f0-9]{32}/i')</strong>); 227 } 228 } 229 </pre> 230 The rest of the test would be the same as any other form, 231 but we might want to confirm that we still have the same 232 cookie after log-in as before we entered. 233 We wouldn't want to lose track of this after all. 234 Here is a possible test for this... 235 <pre> 236 class LogInTest extends WebTestCase { 237 ... 238 function testSessionCookieSameAfterLogIn() { 239 $this->get('http://www.my-site.com/login.php');<strong> 240 $session = $this->getCookie('SID'); 241 $this->setField('u', 'Me'); 242 $this->setField('p', 'Secret'); 243 $this->click('Log in'); 244 $this->assertText('Welcome Me'); 245 $this->assertCookie('SID', $session);</strong> 246 } 247 } 248 </pre> 249 This confirms that the session identifier is maintained 250 afer log-in. 251 </p> 252 <p> 253 We could even attempt to spoof our own system by setting 254 arbitrary cookies to gain access... 255 <pre> 256 class LogInTest extends WebTestCase { 257 ... 258 function testSessionCookieSameAfterLogIn() { 259 $this->get('http://www.my-site.com/login.php');<strong> 260 $this->setCookie('SID', 'Some other session'); 261 $this->get('http://www.my-site.com/restricted.php');</strong> 262 $this->assertText('Access denied'); 263 } 264 } 265 </pre> 266 Is your site protected from this attack? 267 </p> 268 269 <p> 270 <a class="target" name="session"> 271 <h2>Browser sessions</h2> 272 </a> 273 </p> 274 <p> 275 If you are testing an authentication system a critical piece 276 of behaviour is what happens when a user logs back in. 277 We would like to simulate closing and reopening a browser... 278 <pre> 279 class LogInTest extends WebTestCase { 280 ... 281 function testLoseAuthenticationAfterBrowserClose() { 282 $this->get('http://www.my-site.com/login.php'); 283 $this->setField('u', 'Me'); 284 $this->setField('p', 'Secret'); 285 $this->click('Log in'); 286 $this->assertText('Welcome Me');<strong> 287 288 $this->restart(); 289 $this->get('http://www.my-site.com/restricted.php'); 290 $this->assertText('Access denied');</strong> 291 } 292 } 293 </pre> 294 The <span class="new_code">WebTestCase::restart()</span> method will 295 preserve cookies that have unexpired timeouts, but throw away 296 those that are temporary or expired. 297 You can optionally specify the time and date that the restart 298 happened. 299 </p> 300 <p> 301 Expiring cookies can be a problem. 302 After all, if you have a cookie that expires after an hour, 303 you don't want to stall the test for an hour while the 304 cookie passes it's timeout. 305 </p> 306 <p> 307 To push the cookies over the hour limit you can age them 308 before you restart the session... 309 <pre> 310 class LogInTest extends WebTestCase { 311 ... 312 function testLoseAuthenticationAfterOneHour() { 313 $this->get('http://www.my-site.com/login.php'); 314 $this->setField('u', 'Me'); 315 $this->setField('p', 'Secret'); 316 $this->click('Log in'); 317 $this->assertText('Welcome Me'); 318 <strong> 319 $this->ageCookies(3600);</strong> 320 $this->restart(); 321 $this->get('http://www.my-site.com/restricted.php'); 322 $this->assertText('Access denied'); 323 } 324 } 325 </pre> 326 After the restart it will appear that cookies are an 327 hour older and any that pass their expiry will have 328 disappeared. 329 </p> 330 331 </div> 332 <div class="copyright"> 333 Copyright<br>Marcus Baker, Jason Sweat, Perrick Penet 2004 334 </div> 335 </body> 336 </html>
titre
Description
Corps
titre
Description
Corps
titre
Description
Corps
titre
Corps
| Généré le : Sun Feb 25 21:07:04 2007 | par Balluche grâce à PHPXref 0.7 |