Diff options
| author | Bryce Kwon <bryce@brycekwon.com> | |
|---|---|---|
| committer | Bryce Kwon <bryce@brycekwon.com> | |
| commit | ||
| parent | ||
| tree | ||
| download | ||
Check expired and planted sessions on a visit
An expired session was only tried against validate_value, never sent
through a visit, and nothing sent a session under the plain cookie
name, which a sibling subdomain can set where it cannot set the
__Host- one.
| -rw-r--r-- | tests/extensions/test-auth.lua | 7 |
1 file changed, 7 insertions, 0 deletions
diff --git a/tests/extensions/test-auth.lua b/tests/extensions/test-auth.lua index e52b406..822a075 100644 --- a/tests/extensions/test-auth.lua +++ b/tests/extensions/test-auth.lua @@ -448,6 +448,13 @@ h.equals("while one in the second group lets them in", visit("both-repo", outsid local forged = session:sub(1, -2) .. (session:sub(-1) == "0" and "1" or "0") h.equals("a forged session is turned away", visit("secret-repo", forged), 0) +local expired = secure_value("username", "Alice", now - 10, stored_hash) +h.equals("an expired session is turned away", visit("secret-repo", expired), 0) + +-- Only the __Host- name is safe from a cookie a sibling subdomain planted. +local _, planted = run_action("authenticate-cookie", { repo = "secret-repo", cookie = "cgitauth=" .. session }) +h.equals("a session under the plain cookie name is turned away", planted, 0) + -- Only the secret keeps a visitor from signing a session of their own, so -- one signed under any other secret is worthless. local real_get_secret = get_secret |