Diff options
| author | Bryce Kwon <bryce@brycekwon.com> | |
|---|---|---|
| committer | Bryce Kwon <bryce@brycekwon.com> | |
| commit | ||
| parent | ||
| tree | ||
| download | ||
Check that the secret keys every signature
Every check signed and verified under one pinned secret, so a sign()
that left the secret out of the HMAC key, which makes every cookie
forgeable, passed.
Diffstat (limited to 'tests')
| -rw-r--r-- | tests/extensions/test-auth.lua | 12 |
1 file changed, 12 insertions, 0 deletions
diff --git a/tests/extensions/test-auth.lua b/tests/extensions/test-auth.lua index 506babf..5faba1c 100644 --- a/tests/extensions/test-auth.lua +++ b/tests/extensions/test-auth.lua @@ -362,6 +362,18 @@ h.equals("a signed session for an outsider is turned away", visit("secret-repo", local forged = session:sub(1, -2) .. (session:sub(-1) == "0" and "1" or "0") h.equals("a forged session is turned away", visit("secret-repo", forged), 0) +-- Only the secret keeps a visitor from signing a session of their own, so +-- one signed under any other secret is worthless. +local real_get_secret = get_secret +get_secret = function() + return string.rep("fedcba9876543210", 4) +end +h.equals("a session signed under another secret does not verify", + validate_value("username", session, account_hash), nil) +h.equals("and lets nobody in", visit("secret-repo", session), 0) +get_secret = real_get_secret +h.equals("while under its own secret it still does", visit("secret-repo", session), 1) + local _, ret = run_action("no-such-action", {}) h.equals("an unknown action denies rather than raising", ret, 0) |