@Test
    public void allHttpMethodsRequireAuthenticationIfNullConfig() {
        testFilter = new BasicHttpAuthenticationFilter();

        HttpServletRequest request = mock(HttpServletRequest.class);
        when(request.getHeader("Authorization")).then(args -> createAuthorizationHeader("pedro", ""));
        when(request.getRemoteHost()).then(args -> "localhost");
        when(request.getMethod()).then(args -> "GET");
        when(request.getMethod()).then(args -> "POST");

        runWithSubject(subject -> {
            HttpServletResponse response = mock(HttpServletResponse.class);

            boolean accessAllowed = testFilter.isAccessAllowed(request, response, null);
            assertFalse(accessAllowed, "Access allowed for GET");

            accessAllowed = testFilter.isAccessAllowed(request, response, null);
            assertFalse(accessAllowed, "Access allowed for POST");
        });
    }
Test case for {@link BasicHttpAuthenticationFilter}.

@since 1.0
web/src/test/java/org/apache/shiro/web/filter/authc/BasicHttpFilterAuthenticationTest.java