title: Rspec testing API with rack protection
body: <p>I am trying to test my API with an rspec integration(request) test.</p>
  
  <p>I go to my api endpoint at <code>0.0.0.0:3000/api/regions</code> in a browser and it returns my data, I get a session id and looks like everything is working.</p>
  
  <p>I am using rack protection in my API:</p>
  
  <pre><code>module Api
    class Root &lt; Grape::API
       use Rack::Protection, instrumenter: ActiveSupport::Notifications
       use Rack::Protection::AuthenticityToken    
       prefix  'api'
  
       helpers do
          def warden
            request.env['warden']
          end
       end
  
       version 'v1', using: :header, vendor: 'vendor', strict: false do
          mount Resources::V1::Search =&gt; '/'
          mount Resources::V1::Regions =&gt; '/'
       end    
  
     end
  end
  </code></pre>
  
  <p>The api resource:</p>
  
  <pre><code>module Resources
    module V1
      class Regions &lt; Grape::API
  
        resource :regions do
          get do
            # Some code...
          end
        end
      end
    end
  end
  </code></pre>
  
  <p>spec_helper.rb</p>
  
  <pre><code>[...]
  RSpec.configure do |config|
    config.include FactoryGirl::Syntax::Methods
  
    config.include Rack::Test::Methods, type: :request
    config.include Module.new { def app; Api::Root; end }, type: :request
  
    config.include Warden::Test::Helpers
  
    # ## Mock Framework
    #
    # If you prefer to use mocha, flexmock or RR, uncomment the appropriate line:
    #
    # config.mock_with :mocha
    # config.mock_with :flexmock
    # config.mock_with :rr
  
    # Remove this line if you're not using ActiveRecord or ActiveRecord fixtures
    config.fixture_path = "#{::Rails.root}/spec/fixtures"
  
    # If you're not using ActiveRecord, or you'd prefer not to run each of your
    # examples within a transaction, remove the following line or assign false
    # instead of true.
    config.use_transactional_fixtures = true
  
    # If true, the base class of anonymous controllers will be inferred
    # automatically. This will be the default behavior in future versions of
    # rspec-rails.
    config.infer_base_class_for_anonymous_controllers = false
  
    # Run specs in random order to surface order dependencies. If you find an
    # order dependency and want to debug it, you can fix the order by providing
    # the seed, which is printed after each run.
    #     --seed 1234
    config.order = "random"
  end
  </code></pre>
  
  <p>Here is a test: </p>
  
  <pre><code>describe Resources::V1::Regions do
    describe 'GET /regions' do
      it 'returns some data' do
        get '/api/regions'
        [... expectations - doesn't get here...]
      end
    end
  end
  </code></pre>
  
  <p>Here is the error:</p>
  
  <pre><code> RuntimeError:
         you need to set up a session middleware *before* Rack::Protection::RemoteToken
       # ./spec/requests/api/region_spec.rb:6:in `block (3 levels) in &lt;top (required)&gt;'
  </code></pre>
  
  <p>Which comes from here: <a href="https://github.com/rkh/rack-protection/blob/master/lib/rack/protection/base.rb#L85" rel="nofollow">https://github.com/rkh/rack-protection/blob/master/lib/rack/protection/base.rb#L85</a></p>
  
  <p>So I need to add rack session middleware, right?</p>
  
  <p>I add <code>use Rack::Session::Cookie, secret: '...'</code> to my api which gets me to request.env['warden'] being nil (another question another time). </p>
  
  <p><strong>Now, however, when I load the endpoint with the browser I get:</strong></p>
  
  <pre><code>undefined method `each' for #&lt;ActionDispatch::Request::Session:0x7f7bf9e521e0 not yet loaded&gt;
  </code></pre>
  
  <p>which raises over here: <a href="https://github.com/rack/rack/blob/master/lib/rack/session/abstract/id.rb#L158" rel="nofollow">https://github.com/rack/rack/blob/master/lib/rack/session/abstract/id.rb#L158</a></p>
  
  <p>I suspect I don't need to <code>use Rack::Session::Cookie</code>, as something else is doing it when loaded by the server, but I need to add something for the tests to work. No idea what that something is.</p>
  
  <p>Please let me know if you need any other info.</p>
  
  <p>Versions:</p>
  
  <ul>
  <li>grape (0.6.1)</li>
  <li>rails (4.0.2) </li>
  <li>rack-protection (1.5.2)</li>
  <li>rspec (2.14.1)</li>
  </ul>