title: MVC Policy Override in Integration Tests
body: <p>I am in the process of adding integration tests at work for an MVC app. Many of our endpoints have policies applied to them, e.g.</p>
  
  <pre><code>namespace WorkProject
  {
    [Route("A/Route")]
    public class WorkController : Controller
    {
      [HttpPost("DoStuff")]
      [Authorize(Policy = "CanDoStuff")]
      public IActionResult DoStuff(){/* */}
    }
  }
  </code></pre>
  
  <p>For our integration tests, I have overridden the <code>WebApplicationFactory</code> like it is suggested in the <a href="https://docs.microsoft.com/en-us/aspnet/core/test/integration-tests?view=aspnetcore-2.2" rel="noreferrer">ASP .NET Core documentation</a>. My goal was to overload the authentication step and to bypass the policy by making a class which allows all parties through the authorization policy.</p>
  
  <pre><code>namespace WorkApp.Tests
  {
      public class CustomWebApplicationFactory&lt;TStartup&gt; : WebApplicationFactory&lt;TStartup&gt; where TStartup: class
      {
          protected override void ConfigureWebHost(IWebHostBuilder builder)
          {
              base.ConfigureWebHost(builder);
              builder.ConfigureServices(services =&gt;
              {
                  services.AddAuthentication(options =&gt;
                  {
                      options.DefaultAuthenticateScheme = "Test Scheme"; // has to match scheme in TestAuthenticationExtensions
                      options.DefaultChallengeScheme = "Test Scheme";
                  }).AddTestAuth(o =&gt; { });
  
  
                  services.AddAuthorization(options =&gt;
                  {
                      options.AddPolicy("CanDoStuff", policy =&gt;
                          policy.Requirements.Add(new CanDoStuffRequirement()));
                  });
  
               // I've also tried the line below, but neither worked
               // I figured that maybe the services in Startup were added before these
               // and that a replacement was necessary
               // services.AddTransient&lt;IAuthorizationHandler, CanDoStuffActionHandler&gt;();
               services.Replace(ServiceDescriptor.Transient&lt;IAuthorizationHandler, CanDoStuffActionHandler&gt;());
              });
          }
      }
  
      internal class CanDoStuffActionHandler : AuthorizationHandler&lt;CanDoStuffActionRequirement&gt;
      {
          public CanDoStuffActionHandler()
          {
          }
  
          protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, CanDoStuffActionRequirement requirement)
          {
              context.Succeed(requirement);
  
              return Task.CompletedTask;
          }
      }
  
      internal class CanDoStuffRequirement : IAuthorizationRequirement
      {
      }
  }
  </code></pre>
  
  <p>The first thing that I do to the services is override the authentication as suggested <a href="https://medium.com/@jackwild/bypassing-asp-net-core-2-0-authorize-tags-in-integration-tests-7bda8fcb0eca" rel="noreferrer">here</a> (without the bit about overriding <code>Startup</code> since that didn't seem to work for me). I am inclined to believe that this authentication override works. When I run my tests, I receive an HTTP 403 from within the xUnit testing framework. If I hit the route that I am testing from PostMan I receive an HTTP 401. I have also made a class that lives in the custom web application factory that allows all requests for the <code>CanDoStuff</code> authorization handler. I thought this would allow the integration tests through the authorization policy, but, as stated above, I receive an HTTP 403. I know that a 403 will be returned if the app doesn't know where certain files are. However, this is a post route strictly for receiving and processing data and this route does not attempt to return any views so this 403 is most likely related to the authorization policy which, for some reason, is not being overridden.</p>
  
  <p>I'm clearly doing something wrong. When I run the test under debug mode and set a breakpoint in the <code>HandleRequirementsAsync</code> function, the application never breaks. Is there a different way that I should be attempting to override the authorization policies?</p>