Geek Answers Handbook

Testing Remained in Rspec

I am a little fixated on how (and where) to write some rspec tests for the "stay online" feature that you see everywhere, including in the google login.

The examples I found on the Internet did not help. In particular, I want to test these two scenarios.

one

  • a) the user signs up with valid credentials without clicking "stay signed in
  • b) the user closes the browser, reopens it and requests a protection page.
  • The user should not see the protected page.
  • The user should see a page asking to enter it.

2

  • a) the user signs up with valid credentials and clicks "remain signed in
  • b) the user closes the browser, reopens it and requests a secure page.
  • The user should not see a page asking to log in.
  • The user must be delivered to a secure page.

My first attempt to solve the problem was to simulate closing the browser by deleting the user_id that I saved in the session (since it is deleted when the browser is closed). However, these tests failed because I worked in the request specification folder and did not have access to session variables. My previously related question: Session is available in some rspec files and not in others. how did it happen?

What is the best way to run these tests using rspec?

+1
source share
2 answers

I think you should try the standard rails method for integration tests - open_session .
Personally, I have never done this and cannot give you a verified code.

See examples of several sessions in rail guides .

+1
source

There are two problems here that I think apply to different tests:

  • A user cannot access a secure page without logging in. This is a controller check.
  • The user is automatically registered even after the session has been destroyed, so the “remember me” flag was set in the cookie.

For # 1, you can try something like:

 describe UsersController do context "when not logged in" do context "GET users/edit" do it "redirects to login" do get :edit, :id => 123 response.should redirect_to login_path end end end end

You can do a more general test case that claims all actions that are not explicitly specified, so you don’t have test spaces if the access code later becomes more permissive. But this is a more subtle point.

For # 2, you can write a request specification that sets the “remember me” flag, then logs out, then logs back in and verifies that you are on the expected page. Remove all of this from your browser by filling out your credentials, checking the Remember Me box, by clicking the buttons.

Question: why? Why do you want to check this out? Do you use a home login system? Very discouraged if you are not a first-class security expert. If you don’t use the home system, but instead of Devise , which is tested, do not reinstall the library functionality, just check only your application code, for example, access rights to certain pages covered by # 1. You can also look at those tests that are supplied with Devise, how they check this condition.

Hope this helps.

Refresh . To clarify the request specification for # 2. As mentioned in another @cutalion answer (which is trustworthy for the correct answer), a mechanism to verify that the login can be saved when the session is closed is built into the IntegrationTest ActionDispatch infrastructure using open_session .

See the Rails docs IntegrationTest API for examples. A blog post expanding when using custom DSL.

+1
source

More articles:


All Articles