Ktor HTTP Response and Header Test Helpers
Blog post from StackHawk
StackHawk's application scanner, HawkScan, uses Kotlin and the Ktor framework to test various web authentication types, including cookie-based authentication, which involves manipulating HTTP headers to set and retrieve authentication cookies. The testing process for external cookie authentication involves making an initial request to an application, following a redirect to an external host, and retrieving the authentication cookie from the Set-cookie header provided by the external application. To facilitate this, StackHawk employs helper functions such as `startTestWebApp` to start embedded servers and `stopTestWebApps` to clean them up between tests, ensuring that the tests use actual servers rather than mocks for integration testing. These functions, defined in a shared utility file, allow the creation of GET requests with specified response bodies, headers, and status codes, enabling effective verification of the authentication process. The Ktor framework's flexibility and StackHawk's custom utilities streamline the process of writing, reading, and maintaining these authentication tests.