Diff options
| -rw-r--r-- | tests/extensions/test-auth.lua | 12 |
1 file changed, 12 insertions, 0 deletions
diff --git a/tests/extensions/test-auth.lua b/tests/extensions/test-auth.lua index 506babf..5faba1c 100644 --- a/tests/extensions/test-auth.lua +++ b/tests/extensions/test-auth.lua @@ -362,6 +362,18 @@ h.equals("a signed session for an outsider is turned away", visit("secret-repo", local forged = session:sub(1, -2) .. (session:sub(-1) == "0" and "1" or "0") h.equals("a forged session is turned away", visit("secret-repo", forged), 0) +-- Only the secret keeps a visitor from signing a session of their own, so +-- one signed under any other secret is worthless. +local real_get_secret = get_secret +get_secret = function() + return string.rep("fedcba9876543210", 4) +end +h.equals("a session signed under another secret does not verify", + validate_value("username", session, account_hash), nil) +h.equals("and lets nobody in", visit("secret-repo", session), 0) +get_secret = real_get_secret +h.equals("while under its own secret it still does", visit("secret-repo", session), 1) + local _, ret = run_action("no-such-action", {}) h.equals("an unknown action denies rather than raising", ret, 0) |