Code snippets for a blog post on ExVCR

api_client.empty.exs

# test/support/api_client.exs

defmodule ExVCR.Adapter.HackneyTest do
  use ExUnit.Case, async: false
  use ExVCR.Mock, adapter: ExVCR.Adapter.Hackney

  setup_all do
    HTTPoison.start
  end

end

api_client.exs

# test/support/api_client.exs

defmodule ExVCR.Adapter.HackneyTest do
  use ExUnit.Case, async: false
  use ExVCR.Mock, adapter: ExVCR.Adapter.Hackney

  setup_all do
    HTTPoison.start
  end

  test "successful login request" do
    use_cassette "api_client/login" do
      username = System.get_env("API_USERNAME")
      password = System.get_env("API_PASSWORD")

      response = HTTPoison.get! "https://example.com/api/login", [], [hackney: [basic_auth: {username, password}]]
      
      assert response != nil
      assert response.status_code == 200
      body = Poison.decode!(response.body, keys: :atoms!)
      assert body[:res] == "OK"

      cookie = for {"Set-Cookie", cookie} <- response.headers, do: cookie
      assert cookie != nil
    end
  end

end

login.censored.json

# exvcr cassettes with censored sensitive data

[
  {
    "request": {
      "body": "",
      "headers": [],
      "method": "get",
      "options": {
        "basic_auth": "***"
      },
      "request_body": "",
      "url": "https://example.com/api/login"
    },
    "response": {
      "body": "{\"res\":\"OK\"}",
      "headers": {
        "Cache-Control": "max-age=0, private, must-revalidate",
        "Content-Type": "application/json; charset=utf-8",
        "Date": "Tue, 16 May 2017 10:29:34 GMT",
        "ETag": "W/\"df23acc5b53ffca3961972019eefa517\"",
        "Server": "Apache",
        "Set-Cookie": "<<access_key>>",
        "Status": "200 OK",
        "Vary": "Accept-Encoding",
        "X-Content-Type-Options": "nosniff",
        "X-Frame-Options": "SAMEORIGIN",
        "X-XSS-Protection": "1; mode=block",
        "transfer-encoding": "chunked",
        "Connection": "keep-alive"
      },
      "status_code": 200,
      "type": "ok"
    }
  }
]

login.json

# exvcr cassette with fake sensitive data

[
  {
    "request": {
      "body": "",
      "headers": [],
      "method": "get",
      "options": {
        "basic_auth": {
          "username",
          "password"
         }
      },
      "request_body": "",
      "url": "https://example.com/api/login"
    },
    "response": {
      "body": "{\"res\":\"OK\"}",
      "headers": {
        "Cache-Control": "max-age=0, private, must-revalidate",
        "Content-Type": "application/json; charset=utf-8",
        "Date": "Tue, 16 May 2017 10:01:16 GMT",
        "ETag": "W/\"df23acc5b53ffca3961972019eefa517\"",
        "Server": "Apache",
        "Set-Cookie": "_example_session_v6=COOKIESTRING; path=/; HttpOnly",
        "Status": "200 OK",
        "Vary": "Accept-Encoding",
        "X-Content-Type-Options": "nosniff",
        "X-Frame-Options": "SAMEORIGIN",
        "X-Request-Id": "00000000-0000-0000-0000-000000000000",
        "X-XSS-Protection": "1; mode=block",
        "Content-Length": "12",
        "Connection": "keep-alive"
      },
      "status_code": 200,
      "type": "ok"
    }
  }
]

mix.exs

# config/mix.exs
defp deps do
  {:httpoison, "~> 0.11.0"},
  {:exvcr, "~> 0.8", only: :test}
end

test.exs

# config/test.exs

config :exvcr, [
  filter_sensitive_data: [
    [pattern: "_example_session_.*", placeholder: "<<access_key>>"]
  ],
  filter_request_options: ["basic_auth"]
]