Move into nested docroot

web/core/modules/basic_auth/tests/modules/basic_auth_test/basic_auth_test.info.yml

@@ -0,0 +1,6 @@
+name: 'HTTP Basic Authentication test'
+type: module
+description: 'Support module for HTTP Basic Authentication testing.'
+package: Testing
+version: VERSION
+core: 8.x

web/core/modules/basic_auth/tests/modules/basic_auth_test/basic_auth_test.routing.yml

@@ -0,0 +1,16 @@
+basic_auth_test.state.modify:
+  path: '/basic_auth_test/state/modify'
+  defaults:
+    _controller: '\Drupal\basic_auth_test\BasicAuthTestController::modifyState'
+  options:
+    _auth:
+      - basic_auth
+  requirements:
+    _user_is_logged_in: 'TRUE'
+
+basic_auth_test.state.read:
+  path: '/basic_auth_test/state/read'
+  defaults:
+    _controller: '\Drupal\basic_auth_test\BasicAuthTestController::readState'
+  requirements:
+    _access: 'TRUE'

web/core/modules/basic_auth/tests/modules/basic_auth_test/src/BasicAuthTestController.php

@@ -0,0 +1,30 @@
+<?php
+
+namespace Drupal\basic_auth_test;
+
+class BasicAuthTestController {
+
+  /**
+   * @see \Drupal\basic_auth\Tests\Authentication\BasicAuthTest::testControllerNotCalledBeforeAuth()
+   */
+  public function modifyState() {
+    \Drupal::state()->set('basic_auth_test.state.controller_executed', TRUE);
+    return ['#markup' => 'Done'];
+  }
+
+  /**
+   * @see \Drupal\basic_auth\Tests\Authentication\BasicAuthTest::testControllerNotCalledBeforeAuth()
+   */
+  public function readState() {
+    // Mark this page as being uncacheable.
+    \Drupal::service('page_cache_kill_switch')->trigger();
+
+    return [
+      '#markup' => \Drupal::state()->get('basic_auth_test.state.controller_executed') ? 'yep' : 'nope',
+      '#cache' => [
+        'max-age' => 0,
+      ],
+    ];
+  }
+
+}