no documentation about authentication in test

[deronnax]

I have been trying to create a chat app in an existing Django project, and I am surprised by the amount of channels domains not covered by the documentation. I will probably create an issue/discussion for all of them.
The one I have in front of me now is: the documentation talks about authentication, but there is no indication whatsoever on how do it in test.
Are we supposed to feed hand-made headers to the websocket communicator? If that is so, even just a line saying it is the way to go would be huge improvment over head-scratching.
I am willing to add this line, and even go some extra steps if greenlighted.
Cheers.

[huynguyengl99]

Hi @deronnax!

You're right - WebSocket authentication testing requires manual header construction. For your immediate needs:

# Session auth testing pattern
user = User.objects.create_user(username='test', password='test')
self.client.login(username='test', password='test')
cookies = self.client.cookies
headers = [(b"cookie", f"sessionid={cookies['sessionid'].value}".encode())]
communicator = WebsocketCommunicator(Consumer.as_asgi(), "/ws/", headers=headers)

Better Solution: Chanx

I built Chanx specifically to solve this problem. It provides:

Simplified Testing:

from chanx.testing import WebsocketTestCase

class ChatTest(WebsocketTestCase):
    async def test_auth(self):
        await self.auth_communicator.connect()
        await self.auth_communicator.assert_authenticated_status_ok()

DRF-Style Authentication:

from chanx.generic.websocket import AsyncJsonWebsocketConsumer

class ChatConsumer(AsyncJsonWebsocketConsumer[ChatMessage]):
    authentication_classes = [SessionAuthentication]
    permission_classes = [IsAuthenticated]

Multi-User Testing:

# Test multiple authenticated users easily
second_comm = self.create_communicator(headers=different_user_headers)

Links:

• Install: pip install chanx
• Docs: https://chanx.readthedocs.io/en/latest/user-guide/testing.html
• Example: https://github.com/huynguyengl99/chanx-example

This addresses exactly the documentation gaps you mentioned! 🚀

[deronnax]

@carltongibson I am sincerely sorry to ping you (I know open-source maintainers are overwhelmed with the maintenance burden and over-solicitation of open-source projects), but I did not get an answer from you, and I really would like your insights about this. To me at least those subjects are missing from the Testing section:

• authentication
• session IIRC
• I had several weird issues accessing the database, and Claude Sonnet made me switch the Django's TransactionTestCase, it solved them, so I was wondering if there isn't something worth documenting (I haven't investigated this case yet but I could).
  I would love your insights.
  Thank you very much.

[huynguyengl99]

Hi @deronnax, while waiting for feedback from Carlton Gibson, I’d like to share some insights based on my long experience working with Django Channels — hopefully they’re helpful for what you’re facing now:
• For testing classes: I also use Django’s TransactionTestCase, just like you. I ran into some connection-closing issues before, and switching to TransactionTestCase completely resolved them. It has worked well for a long time, so I’d recommend using it as the base test case.
• For authentication: I’m not sure if you’re trying to authenticate WebSocket connections in production or just for testing. In my project, I use a JWT HttpOnly cookie, and it works quite well. Since a WebSocket connection begins as an HTTP request, the JWT HttpOnly cookie is automatically sent with the connection, so it’s available during connect.
We chose to use the JWT HttpOnly cookie — the same one used by DRF — to keep the behavior consistent with our API authentication. We wrote a small custom piece based on Django’s CookieMiddleware to parse the scope, convert it into a DRF request, and perform authentication. It’s been working reliably for us.
Other options, like using query parameters as authentication tickets, exist, but we found the JWT HttpOnly cookie approach more secure and convenient.
When writing tests, we inherit from TransactionTestCase, create a WebSocket communicator, and attach the JWT cookie for authentication — that setup works well in our case.

[carltongibson]

Yeah, thanks @huynguyengl99. I don't have too much to add to be honest. I'm always open to improvements to the documentation but I had read @huynguyengl99 initial response as resolving the query.