如何对Web API 2的防伪令牌过滤器进行单元测试

Question

I am trying to write unit test case using MsTest for custom filter which has the logic to validate the Antiforgerytoken for POST method in ASP.NET WEB API 2 project.

[AttributeUsage(AttributeTargets.Method, Inherited = true)]
public class ValidateJsonAntiForgeryTokenAttribute : ActionFilterAttribute
{
    public override void OnActionExecuting(HttpActionContext actionContext)
    {
        try
        {

            string cookieToken = null;
            string formToken = null;

            if (actionContext.Request.IsAjaxRequest())
            {
                IEnumerable<string> tokenHeaders;
                if (actionContext.Request.Headers.TryGetValues("__RequestVerificationToken", out tokenHeaders))
                {
                    string[] tokens = tokenHeaders.First().Split(':');
                    if (tokens.Length == 2)
                    {
                        cookieToken = tokens[0].Trim();
                        formToken = tokens[1].Trim();
                    }
                }
                if (cookieToken != null && formToken !=null)
                {
                    AntiForgery.Validate(cookieToken, formToken);
                }
                else
                {
                    AntiForgery.Validate();
                }                    
            }

        }
        catch (Exception ex)
        {
            ErrorSignal.FromCurrentContext().Raise(ex);
            actionContext.Response = actionContext.Request.CreateResponse(HttpStatusCode.Forbidden);
        }            
    }
}

In the below code IsAjaxRequest is an extension method

public static class HttpRequestMessageExtensions
{
    public static bool IsAjaxRequest(this HttpRequestMessage request)
    {
        IEnumerable<string> headers;
        if (request.Headers.TryGetValues("X-Requested-With", out headers))
        {
            var header = headers.FirstOrDefault();
            if (!string.IsNullOrWhiteSpace(header))
            {
                return header.ToLowerInvariant() == "xmlhttprequest";
            }
        }

        return false;
    }
}

Here my issue how to mock the IsAjaxRequest and how to pass actionContext parameter to the OnActionExecuting method.

Can anyone help me to provide some code samples regarding this?

Answer 1

IsAjaxRequest is an extension method which mean it is a static method.

You shouldn't mock static methods. You should test it as a part of your method under test behavior.

The following example shows how to test invalid request:(I removed the :: ErrorSignal.FromCurrentContext().Raise(ex); since I didn't know which assembly to add... so add the missing assert\\s in your test...)

[TestMethod]
public void TestMethod1()
{
    var target = new ValidateJsonAntiForgeryTokenAttribute();
    var requestMessage = new HttpRequestMessage();
    requestMessage.Headers.Add("X-Requested-With", new[] {"xmlhttprequest"});
    var fakeDescriptor = new Mock<HttpActionDescriptor>();
    var controllerContext = new HttpControllerContext {Request = requestMessage};
    var context = new HttpActionContext(controllerContext, fakeDescriptor.Object);


    target.OnActionExecuting(context);


    Assert.AreEqual(HttpStatusCode.Forbidden, actionContext.Response.StatusCode);
}

Answer 2

You can mock the static method if you really need to. There's my example of the test with Typemock isolator:

[TestMethod, Isolated]
public void TestValidate()
{
    //How to fake action context to further passing it as a parameter:
    var fake = Isolate.Fake.AllInstances<HttpActionContext>();
    Isolate.Fake.StaticMethods<HttpActionContext>();

    //How to mock IsAjaxRequset:
    var request = new HttpRequestMessage();
    Isolate.WhenCalled(() => request.IsAjaxRequest()).WillReturn(true);            

    //Arrange:
    ValidateJsonAntiForgeryTokenAttribute target = new ValidateJsonAntiForgeryTokenAttribute();
    Isolate.WhenCalled(() => AntiForgery.Validate()).IgnoreCall();

    //Act:
    target.OnActionExecuting(fake);

    //Assert:
    Isolate.Verify.WasCalledWithAnyArguments(() => AntiForgery.Validate());
}