@Test
    public void httpMethodsAreCaseInsensitive() {
        testFilter = new BasicHttpAuthenticationFilter();

        HttpServletRequest request = mock(HttpServletRequest.class);
        when(request.getMethod()).then(args -> "GET");
        when(request.getHeader("Authorization")).then(args -> createAuthorizationHeader("pedro", ""));
        when(request.getRemoteHost()).then(args -> "localhost");

        HttpServletResponse response = mock(HttpServletResponse.class);

        runWithSubject(subject -> {
            boolean accessAllowed = testFilter.isAccessAllowed(request, response, new String[] {"POST", "put", "delete"});
            assertTrue(accessAllowed, "Access not allowed for GET");

            when(request.getMethod()).then(args -> "post");
            accessAllowed = testFilter.isAccessAllowed(request, response, new String[] {"post", "put", "delete"});
            assertFalse(accessAllowed, "Access allowed for POST");
        });
    }
Test case for {@link BasicHttpAuthenticationFilter}.

@since 1.0
web/src/test/java/org/apache/shiro/web/filter/authc/BasicHttpFilterAuthenticationTest.java