Diff options
| author | Bryce Kwon <bryce@brycekwon.com> | |
|---|---|---|
| committer | Bryce Kwon <bryce@brycekwon.com> | |
| commit | ||
| parent | ||
| tree | ||
| download | ||
Take a signed cookie apart with one match
The loop let a valid cookie through with a field appended, a doubled
separator or a zero in front of its expiry. The payload now carries the
expiry as written, so only the spelling secure_value issues verifies.
Diffstat (limited to 'tests')
| -rw-r--r-- | tests/extensions/test-auth.lua | 1 |
1 file changed, 1 insertion, 0 deletions
diff --git a/tests/extensions/test-auth.lua b/tests/extensions/test-auth.lua index 742eabe..48c2add 100644 --- a/tests/extensions/test-auth.lua +++ b/tests/extensions/test-auth.lua @@ -192,6 +192,7 @@ h.equals("a value signed for one field does not serve another", validate_value(" h.equals("no cookie does not verify", validate_value("username", nil), nil) h.equals("a tiny cookie does not verify", validate_value("username", "ab"), nil) h.equals("a leading separator does not verify", validate_value("username", "|x|1|s|sig"), nil) +h.equals("a trailing field does not verify", validate_value("username", cookie .. "|x"), nil) h.equals("an unsigned cookie does not verify", validate_value("username", "username|alice|123|salt"), nil) h.equals("an exponent spelling of the expiry does not verify", |