Skip to main content

OWIN, OAuth - Bearer tokens: Authentication and Authorization for unit tests

It is a fact that nowadays, SPA applications are used in almost all new web project. In general behind a SPA application we have multiple REST endpoints that are used to get data, execute different actions and many more.
Token base authentication is worldwide use when we need to secure a REST endpoint and offer a mechanism for authentication and authorization.
In general when we create a SPA application using AngularJS we will use token based authentication. This mean that we will have an endpoint called ‘token’ (or other path) where users can send their username and password and receive a token that can be used to access different resources. Once we have the token, we will set the bearer token value of the authorization heather.

Beside this we need to be able to write unit tests or integration tests that hit our REST services and validate their functionality. For this purpose we need to have a code that simulates the authentication step and inject in the REST request the bearer token.
Below you can find the C# code that can be used for this purpose. In constructor, the REST endpoint is called and access token is created. Once this step is done, the "SetAuthorizationToken" can be called to set the authorization token on http client.
public class AuthorizationHelper
    private string accessToken;

    public AuthorizationHelper(string serverUrl, string username, string password)
        ResolveBearerToken(username, password, serverUrl);

    private void ResolveBearerToken(string username, string password, string serverUrl)
        using (HttpClient httpClient = new HttpClient())
            httpClient.BaseAddress = new Uri(serverUrl);

            // Have to
            StringContent content = new StringContent(
                                            string.Format("grant_type=password&username={0}&password={1}", username, password),
            Task<HttpResponseMessage> responseTask = httpClient.PostAsync("token", content);
            HttpResponseMessage response = responseTask.Result;

            if (response.StatusCode != HttpStatusCode.OK)
                throw new Exception(string.Format("Auth failed for user '{0}' with status code '{1}'", username,

            Task<object> readResponseTask = response.Content.ReadAsAsync<object>();
            dynamic responseContent = readResponseTask.Result;
            accessToken = responseContent.access_token;

            if (accessToken == null)
                throw new Exception("Auth token is null.");

    private static void SetHeatherInformation(HttpClient httpClient)
        httpClient.DefaultRequestHeaders.UserAgent.ParseAdd(@"Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.91 Safari/537.36");
        httpClient.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue(@"text/plain"));
        httpClient.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue(@"*/*"));            
        httpClient.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue("application/x-www-form-urlencoded"));

    public void SetAuthorizationToken(HttpClient httpClient)
        httpClient.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", accessToken);



Popular posts from this blog

ADO.NET provider with invariant name 'System.Data.SqlClient' could not be loaded

Today blog post will be started with the following error when running DB tests on the CI machine:
threw exception: System.InvalidOperationException: The Entity Framework provider type 'System.Data.Entity.SqlServer.SqlProviderServices, EntityFramework.SqlServer' registered in the application config file for the ADO.NET provider with invariant name 'System.Data.SqlClient' could not be loaded. Make sure that the assembly-qualified name is used and that the assembly is available to the running application. See for more information. at System.Data.Entity.Infrastructure.DependencyResolution.ProviderServicesFactory.GetInstance(String providerTypeName, String providerInvariantName) This error happened only on the Continuous Integration machine. On the devs machines, everything has fine. The classic problem – on my machine it’s working. The CI has the following configuration:

TeamCity.NET 4.51EF 6.0.2VS2013
It seems that there …

Entity Framework (EF) TransactionScope vs Database.BeginTransaction

In today blog post we will talk a little about a new feature that is available on EF6+ related to Transactions.
Until now, when we had to use transaction we used ‘TransactionScope’. It works great and I would say that is something that is now in our blood.
using (var scope = new TransactionScope(TransactionScopeOption.Required)) { using (SqlConnection conn = new SqlConnection("...")) { conn.Open(); SqlCommand sqlCommand = new SqlCommand(); sqlCommand.Connection = conn; sqlCommand.CommandText = ... sqlCommand.ExecuteNonQuery(); ... } scope.Complete(); } Starting with EF6.0 we have a new way to work with transactions. The new approach is based on Database.BeginTransaction(), Database.Rollback(), Database.Commit(). Yes, no more TransactionScope.
In the followi…

GET call of REST API that contains '/'-slash character in the value of a parameter

Let’s assume that we have the following scenario: I have a public HTTP endpoint and I need to post some content using GET command. One of the parameters contains special characters like “\” and “/”. If the endpoint is an ApiController than you may have problems if you encode the parameter using the http encoder.
using (var httpClient = new HttpClient()) { httpClient.BaseAddress = baseUrl; Task<HttpResponseMessage> response = httpClient.GetAsync(string.Format("api/foo/{0}", "qwert/qwerqwer"))); response.Wait(); response.Result.EnsureSuccessStatusCode(); } One possible solution would be to encode the query parameter using UrlTokenEncode method of HttpServerUtility class and GetBytes method ofUTF8. In this way you would get the array of bytes of the parameter and encode them as a url token.
The following code show to you how you could write the encode and decode methods.