Hold signatures to the length SHA-256 gives

The fake HMAC returned 16 bytes, so the checks signed with signatures
half the real length, and a signature cut short passed. tohex's output
was never pinned either, so dropping its zero padding stayed
consistent with itself and passed.

1 file changed, 3 insertions, 0 deletions

diff --git a/tests/extensions/test-auth.lua b/tests/extensions/test-auth.luaindex d91287a..a7e1b70 100644--- a/tests/extensions/test-auth.lua+++ b/tests/extensions/test-auth.lua@@ -292,6 +292,9 @@ local now = os.time()  local cookie = secure_value("username", "alice", now + 3600) h.equals("a signed value verifies and comes back", validate_value("username", cookie), "alice")+local signature = cookie:match("|(%x+)$")+h.equals("its signature is a whole SHA-256 in hex", signature and #signature, 64)+h.equals("each byte becomes two hex digits", tohex("\0\15\255"), "000fff")  cookie = secure_value("username", "a|b", now + 3600) h.equals("a value holding the separator survives the round trip", validate_value("username", cookie), "a|b")
diff --git a/tests/extensions/test-auth.lua b/tests/extensions/test-auth.lua
index d91287a..a7e1b70 100644
--- a/tests/extensions/test-auth.lua
+++ b/tests/extensions/test-auth.lua
@@ -292,6 +292,9 @@ local now = os.time()
 
 local cookie = secure_value("username", "alice", now + 3600)
 h.equals("a signed value verifies and comes back", validate_value("username", cookie), "alice")
+local signature = cookie:match("|(%x+)$")
+h.equals("its signature is a whole SHA-256 in hex", signature and #signature, 64)
+h.equals("each byte becomes two hex digits", tohex("\0\15\255"), "000fff")
 
 cookie = secure_value("username", "a|b", now + 3600)
 h.equals("a value holding the separator survives the round trip", validate_value("username", cookie), "a|b")