Diff options
| author | Bryce Kwon <bryce@brycekwon.com> | |
|---|---|---|
| committer | Bryce Kwon <bryce@brycekwon.com> | |
| commit | ||
| parent | ||
| tree | ||
| download | ||
Sign the malformed cookies the checks refuse
The exponent and leading separator cases carried a made-up signature,
which fails the check whatever the parsing does, so loosening the
expiry pattern or dropping its start anchor passed. Both are now built
from properly signed tokens.
Diffstat (limited to 'tests/extensions/test-auth.lua')
| -rw-r--r-- | tests/extensions/test-auth.lua | 6 |
1 file changed, 3 insertions, 3 deletions
diff --git a/tests/extensions/test-auth.lua b/tests/extensions/test-auth.lua index 1531040..17cb805 100644 --- a/tests/extensions/test-auth.lua +++ b/tests/extensions/test-auth.lua @@ -332,12 +332,12 @@ h.equals("nor a way back pointed at another page", h.equals("no cookie does not verify", validate_value("username", nil), nil) h.equals("a tiny cookie does not verify", validate_value("username", "ab"), nil) -h.equals("a leading separator does not verify", validate_value("username", "|x|1|s|sig"), nil) +h.equals("a leading separator does not verify", validate_value("username", "|" .. cookie), nil) h.equals("a trailing field does not verify", validate_value("username", cookie .. "|x"), nil) h.equals("an unsigned cookie does not verify", validate_value("username", "username|alice|123|salt"), nil) -h.equals("an exponent spelling of the expiry does not verify", - validate_value("username", "username|alice|1e9|salt|beef"), nil) +h.equals("an exponent spelling of the expiry does not verify, even signed", + validate_value("username", secure_value("username", "alice", "1e10")), nil) h.equals("an empty value signs to nothing", secure_value("username", "", 1), "") -- The headers the filter writes itself. |