title: Apache Wink Client - Test a REST service using form auth
body: <p>I am trying to use the Wink RestClient to do functional testing on a Rest service endpoint.  I use mocks for unit testing but I'd like to functionally test it as an endpoint consumer.</p>
  
  <p>I understand some will object to me calling it a REST endpoint while using form-based auth but that is the current architecture I have.</p>
  
  <p>The majority of the resources I want to test are protected resources and the application (running on Tomcat6) is protected by form authentication. (as in the below web.xml snippet).</p>
  
  <p>What I've tried so far is to make an initial call to an unprotected resource, to obtain the set-cookie header, that contains JSESSIONID, and use that JSESSIONID in the header ( via Resource.cookie() ) in subsequent requests but that does not yield fruit.  </p>
  
  <pre><code>web.xml
  
  &lt;login-config&gt;
      &lt;auth-method&gt;FORM&lt;/auth-method&gt;
      &lt;form-login-config&gt;
          &lt;form-login-page&gt;/login.html&lt;/form-login-page&gt;
          &lt;form-error-page&gt;/login.html?failure=true&lt;/form-error-page&gt;
      &lt;/form-login-config&gt;
  &lt;/login-config&gt;
  </code></pre>
  
  <p>My Wink RestClient code looks like below.  All responses are 200, but two things I notice are that the response from the call to /j_security_check/ does not include the jsessionid cookie, and the call to the protected resource said I had a signin failure.  The payload for the call to j_security_check was captured directly from a previous successful browser request intercepted.</p>
  
  <pre><code>ClientConfig config = new ClientConfig();
  config.setBypassHostnameVerification(true);
  RestClient restClient = new RestClient(config);
  
  Resource unprotectedResource = restClient.resource( BASE_URL + "/");
  unprotectedResource.header( "Accept", "*/*" );
  ClientResponse clientResponse = unprotectedResource.get();
  String response = clientResponse.getEntity(String.class);
  
  // get jSession ID
  String jSessionId = clientResponse.getHeaders().get("set-cookie").get(0);
  jSessionId = jSessionId.split(";")[0];
  System.out.println(jSessionId);
  
  // create a request to login via j_security_check
  Resource loginResource = restClient.resource(BASE_URL + "/j_security_check/");
  loginResource.accept("text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8");
  loginResource.header("referer", "http://localhost:8080/contextroot/");
  loginResource.cookie( jSessionId );
  loginResource.header("Connection", "keep-alive");
  loginResource.header("Content-Type", "application/x-www-form-urlencoded");
  loginResource.header("Content-Length", "41");
  
  ClientResponse loginResponse = loginResource.post("j_username=*****&amp;j_password=*************");
  
  /*  the loginResponse, as this point, does not have the jsessionid cookie, my browser client does */
  
  Resource protectedResource = restClient.resource(BASE_URL + "/protected/test/");
  systemResource.accept("application/json");
  systemResource.cookie( jSessionId );
  
  ClientResponse systemResponse = systemResource.get();
  response = clientResponse.getEntity(String.class);
  System.out.println(response);
  </code></pre>
  
  <p>Any thoughts or experience with using the Wink RestClient to exercise form-auth-protected resources would be greatly appreciated.  I suppose I'd entertain other frameworks, I have heard of REST-Assured and others, but since the application uses Wink and the RestClient seems to provide me with what I need, I figured I'd stick with it.</p>