Testing in Django Tutorial #11 - Testing Authentication

Key Takeaways

in Jango applications many scenarios require authentication and they require that resources are protected from unauthenticated users and these are important use cases for writing tests you need to make sure that your protected resources are not exposed to people that shouldn't have access to them and that comes into permissions as well as authentication in this video we're going to look at testing authentication scenarios and we've done a bit of setup code for these so you can see in views.py at the moment we are importing the login required decorator and we have a profile view here that is protected by login required and that means that only authenticated users can access this particular page and access the profile. HTML template that's returned and we also have a simple login view here that just returns login. HTML and that's not protected by login required now I've added both of these views to the URL patterns as you can see at the bottom here and as well as that what I've done is set a login URL setting in jangle and that tells jangle where to redirect users that try and access a protected resource those users need to be redirected to a login page and the login URL here is going to tell Jango where that is and we also have two templates one is a very simple login template and the content of this doesn't really matter for this video and we also have the profile template that's protected by the login required decorator and that gives the usern name's profile page so what we want to do here is write tests that make sure that only authenticated users can view the profile page and we also want to test for the case when an un authenticated user is going to send a request to the profile page we're going to make sure they're redirected to that login URL now because we're testing views here with this authentication process what we're going to do is go to the tests directory and we're going to extend the test views.py fill that we've already seen in this series and we're going to write some new classes that are going to subass the test case for our profile page view and because we're going to log in users using these tests I'm also going to import the user model that we have in the product do models module and at the top of this file let's write a new class and we're going to call this test profile page and that's going to inherit from the test case from Jango and let's write a method in this class called test profile view accessible for authenticated users so we're going to test that authenticated users can access the profile page and in order to test that what we're going to do is we're going to create a test user so let's use the user. objects. create uncore user function and we can give this guy some generic details for username and password now before we send a request to the profile view we need to log the user in so how do you authenticate a user in a test in jangle what we can do is we can use a method on the client and remember the jangle test client that we've been working with in previous videos and this client allows you to send get and post requests to the back end but what it also does is allows you to log in a user with a set of credentials so what I'm going to do to the login method is pass these credentials that we created above so we pass these back into the login method and that's basically going to create a session in jangle for the rest of this test method we can then get a response by calling self. client. getet and we're going to reverse the protected profile route that we have in the application so we use the reverse function and the profile route is what we've added as you can see here it's got a name of profile and that's the one that's protected by login required but we have now logged in so we expect to be able to see this and not to be redirected so let's check that the user's username is in the response context and why are we doing that if we go back to the template and that's in the templates directory and it's profile. HTML you can see here the username is rendered out along with the text your profile page so we expect to see the username in the response when we are sending a request with an authenticated user so what we can do here is use a method that we've seen a couple of times before and that's assert contains we pass the response into that and we expect the username to be in that response you can see the username here it's test user so let's pass that string in here and we can then save this method now that's the happy path so to speak that's when we log the user in and we make sure that they can access the authenticated page but we also want to add a test for unauthenticated users so what I'm going to do just at the top of this above the existing method is write a new one and it's called test profile view redirects for anonymous users and again we use very verbose names for these methods now we can essentially copy the logic from the bottom of the previous method so let's let's copy that and I'm going to paste that into this method so what we're doing here is we're sending a request to the profile page but in this particular method we're not bothering creating any users or logging them in so we don't have a session here we don't have an authenticated user so we expect to see a different response here when we call the get method on the test client so we're going to need to change what comes below here so I'm going to remove this line of code and we're going to see another assert method here and I'm going to bring this onto the same line and this is added by Jango as well it's the assert redirect method and we can pass the response into that now if you just want to assert that it's redirected that's all you need to do here but you can also pass an expected URL so this is going to assert that a response is redirected to a specific URL and I'm actually going to pass an F string in here and let's explain what this F string is so we reverse the login page and that's because when we try and access a page that's behind authentication and we're not authenticated we're going to get redirected to the login page here and that's because we've set the login UR l in settings. pi so we use the reverse function on the login URL and then we're adding a query parameter of next and that's going to capture that the page we want to go to after we log in is going to be the profile page and Jango does that by adding a next URL parameter so that's the expected URL here and we can pass that to the assert redirects function now I want to test this out so let's go back to the terminal and run python manage.py test and you can see we have 13 tests and all of them are passing and again we can narrow the scope of these tests so in the products application we have the tests directory and let's look at test views.py and we can actually pass a class to this so I'm going to pass test profile page and that's only going to run the two tests in that class and you can see that they're both passing so to summarize these kind of tests here are very important if you have pages and resources that are behind authentication you need to make sure your application is not going to expose those and it's going to perform the right behavior for unauthenticated users and writing tests for these scenarios is going to make sure that if some other developer accidentally removes the login required decorator here it's not going to break the entire application if you run the tests and you discover that issue so let's bring back The Decorator and that's going to be all for this video we're going to move on in the next video and look at some more advanced testing Concepts in jangle for example we're going to look at mocking external resources so that's coming up in the next video thanks very much for watching and we'll see you there