ruby script/plugin install git://github.com/matthewrudy/http_authentication.git –force

class PostsController < ApplicationController
  USER_NAME, PASSWORD = "dhh", "secret"
  
  before_filter :authenticate, :except => [ :index ]
  
  def index
    render :text => "Everyone can see me!"
  end
  
  def edit
    render :text => "I'm only accessible if you know the password"
  end
  
  private
    def authenticate
      authenticate_or_request_with_http_basic do |user_name, password| 
        user_name == USER_NAME && password == PASSWORD
      end
    end
end

Here is a more advanced Basic example where only Atom feeds and the XML API is protected by HTTP authentication,
the regular HTML interface is protected by a session approach (NOTE: This example requires Rails Edge as
it uses Request#format, which is not available in Rails 1.2.0):

class ApplicationController < ActionController::Base
  before_filter :set_account, :authenticate

  protected
    def set_account
      @account = Account.find_by_url_name(request.subdomains.first)
    end
  
    def authenticate
      case request.format
      when Mime::XML, Mime::ATOM
        if user = authenticate_with_http_basic { |u, p| @account.users.authenticate(u, p) }
          @current_user = user
        else
          request_http_basic_authentication
        end
      else
        if session_authenticated?
          @current_user = @account.users.find(session[:authenticated][:user_id])
        else
          redirect_to(login_url) and return false
        end
      end
    end
end

In your integration tests, you can do something like this:

def test_access_granted_from_xml
  get(
    "/notes/1.xml", nil, 
    :authorization => HttpAuthentication::Basic.encode_credentials(users(:dhh).name, users(:dhh).password)
    )

  assert_equal 200, status
end

There is currently no advanced documentation for this plugin.