Testing authentication#

Practice shows us that most API endpoints will be using some form of authentication.

There are two ways to test it with django-modern-rest.

The correct way to test auth#

We don’t ship our own version of force_authenticate or similar functions. Because auth is one of the most important parts of your app. We must not ship any simple ways to bypass it easily. In this case most users will just bypass it in their apps.

How do you test views with auth? By providing it!

test_view_with_auth.py#

[source]

import json
from http import HTTPStatus

import pytest
from django.contrib.auth.models import User
from django.http import HttpResponse

from dmr.security.token.app.models import Token
from dmr.test import DMRRequestFactory
from examples.auth.token.using_token_header import APIController


@pytest.fixture
def token_auth(admin_user: User) -> tuple[Token, str]:
    return Token.issue(user=admin_user, name='test-token')


def test_view_with_auth(
    dmr_rf: DMRRequestFactory,
    token_auth: tuple[Token, str],
) -> None:
    request = dmr_rf.get('/api/url', headers={'X-API-Token': token_auth[1]})

    response = APIController.as_view()(request)

    assert isinstance(response, HttpResponse)
    assert response.status_code == HTTPStatus.OK, response.content
    assert json.loads(response.content) == 'authed'

In this test we:

Create a real auth Token instance
Provide a real request header
Use real auth logic to authenticate the request

We test that our real auth works the way we want it to.

The faster way to test auth#

Added in version 0.13.0.

But, we don’t always strictly need to test auth again and again. Only several tests might be enough. Especially, if this auth is rather slow due to 3rd party HTTP requests or a lot of crypto computations.

To fix this, we have a special function / pytest fixture to disabled the auth for some specific endpoint.

Here’s how it can be used:

test_view_disabled_auth.py#

[source]

import json
from http import HTTPStatus

from django.contrib.auth.models import User
from django.http import HttpResponse

from dmr.test import DMRRequestFactory, disabled_auth
from examples.auth.token.using_token_header import APIController, token_auth


def test_view_disabled_auth(
    dmr_rf: DMRRequestFactory,
    admin_user: User,
) -> None:
    request = dmr_rf.get('/api/url')

    with disabled_auth(
        APIController,
        request=request,
        user=admin_user,
        auth=token_auth,
    ):
        # No `X-API-Token` header is passed:
        response = APIController.as_view()(request)

    # But, request is successful:
    assert isinstance(response, HttpResponse)
    assert response.status_code == HTTPStatus.OK, response.content
    assert json.loads(response.content) == 'authed'

Use this approach together with our request factories. Works for both pytest and unittest.

Our design goals here are:

Provide a utility for a non-common use-case
Make sure it does not compromise / affect / have a single source code change in the real auth flow, so no security problems can actually happen in production

Tip

Do not use django.test.Client.force_login(), because it will use the default Django’s login / auth logic, not django-modern-rest custom one.