Diff options
| author | Bryce Kwon <bryce@brycekwon.com> | |
|---|---|---|
| committer | Bryce Kwon <bryce@brycekwon.com> | |
| commit | ||
| parent | ||
| tree | ||
| download | ||
Sign the malformed cookies the checks refuse
The exponent and leading separator cases carried a made-up signature,
which fails the check whatever the parsing does, so loosening the
expiry pattern or dropping its start anchor passed. Both are now built
from properly signed tokens.
| -rw-r--r-- | tests/extensions/test-auth.lua | 6 |
1 file changed, 3 insertions, 3 deletions
diff --git a/tests/extensions/test-auth.lua b/tests/extensions/test-auth.lua index 1531040..17cb805 100644 --- a/tests/extensions/test-auth.lua +++ b/tests/extensions/test-auth.lua @@ -332,12 +332,12 @@ h.equals("nor a way back pointed at another page", h.equals("no cookie does not verify", validate_value("username", nil), nil) h.equals("a tiny cookie does not verify", validate_value("username", "ab"), nil) -h.equals("a leading separator does not verify", validate_value("username", "|x|1|s|sig"), nil) +h.equals("a leading separator does not verify", validate_value("username", "|" .. cookie), nil) h.equals("a trailing field does not verify", validate_value("username", cookie .. "|x"), nil) h.equals("an unsigned cookie does not verify", validate_value("username", "username|alice|123|salt"), nil) -h.equals("an exponent spelling of the expiry does not verify", - validate_value("username", "username|alice|1e9|salt|beef"), nil) +h.equals("an exponent spelling of the expiry does not verify, even signed", + validate_value("username", secure_value("username", "alice", "1e10")), nil) h.equals("an empty value signs to nothing", secure_value("username", "", 1), "") -- The headers the filter writes itself. |