How do you unit test web page authorization using ASP.NET MVC?
- by Kevin Pang
Let's say you have a profile page that can only be accessed by the owner of that profile. This profile page is located at:
User/Profile/{userID}
Now, I imagine in order to prevent access to this page by other users, you could structure your UserController class's Profile function to check the current session's identity:
HttpContext.Current.User.Identity.Name
If the id matches the one in the url, then you proceed. Otherwise you redirect to some sort of error page.
My question is how do you unit test something like this? I'm guessing that you need to use some sort of dependency injection instead of the HttpContext in the controller to do the check on, but I am unclear what the best way to do that is. Any advice would be helpful.
