@Test
    public void createTokenNoPassword() {
        testFilter = new BasicHttpAuthenticationFilter();
        HttpServletRequest request = mock(HttpServletRequest.class);
        when(request.getHeader("Authorization")).then(args -> createAuthorizationHeader("pedro", ""));
        when(request.getRemoteHost()).then(args -> "localhost");

        HttpServletResponse response = mock(HttpServletResponse.class);

        runWithSubject(subject -> {
            AuthenticationToken token = testFilter.createToken(request, response);
            assertNotNull(token);
            assertTrue(token instanceof UsernamePasswordToken, "Token is not a username and password token.");

            UsernamePasswordToken upToken = (UsernamePasswordToken) token;
            assertEquals("pedro", upToken.getUsername());
            assertEquals(0, upToken.getPassword().length, "Password is not empty.");

            verify(request).getHeader("Authorization");
            verify(request).getRemoteHost();
        });
    }
Test case for {@link BasicHttpAuthenticationFilter}.

@since 1.0
web/src/test/java/org/apache/shiro/web/filter/authc/BasicHttpFilterAuthenticationTest.java