1 file changed, 4 insertions, 1 deletion

diff --git a/tests/extensions/test-auth.lua b/tests/extensions/test-auth.luaindex ac849c6..e52b406 100644--- a/tests/extensions/test-auth.lua+++ b/tests/extensions/test-auth.lua@@ -478,6 +478,7 @@ h.contains("a visitor signed in without access is told so", out, 	"<p class='login-error' role='alert'>You are signed in but have no access to this repository.</p>") h.check("and can still sign in as someone else", way_back_in(out) ~= nil) out = run_action("body", { cookie = session_name .. "=" .. forged })+h.contains("a visitor with a forged session is still shown the form", out, "<form class='login'") h.excludes("a forged session is not taken for a signed-in visitor", out, "signed in")  -- The session cookie is Secure, so a form served over plain http would only@@ -487,6 +488,7 @@ h.contains("over plain http the form says logging in needs https", out, 	"<p class='login-error' role='alert'>Logging in only works over https.</p>") h.check("and is still there to fill in", way_back_in(out) ~= nil) out = run_action("body", {})+h.contains("over https the form is shown", out, "<form class='login'") h.excludes("over https it says nothing of the kind", out, "only works over https")  out = run_action("body", { url = "//evil.example/x" })@@ -645,7 +647,8 @@ out = login("Alice", password, way_back) h.contains("an insecure session cookie keeps its plain name", out, "Set-Cookie: cgitauth=") h.excludes("and is not marked Secure", out, "; Secure") out = run_action("body", { https = "" })-h.excludes("so its form does not ask for https", out, "only works over https")+h.contains("so its form is shown over plain http", out, "<form class='login'")+h.excludes("without asking for https", out, "only works over https") load_script()  -- A cookie carries whole seconds, while on Lua 5.3 and later a session length
diff --git a/tests/extensions/test-auth.lua b/tests/extensions/test-auth.lua
index ac849c6..e52b406 100644
--- a/tests/extensions/test-auth.lua
+++ b/tests/extensions/test-auth.lua
@@ -478,6 +478,7 @@ h.contains("a visitor signed in without access is told so", out,
 	"<p class='login-error' role='alert'>You are signed in but have no access to this repository.</p>")
 h.check("and can still sign in as someone else", way_back_in(out) ~= nil)
 out = run_action("body", { cookie = session_name .. "=" .. forged })
+h.contains("a visitor with a forged session is still shown the form", out, "<form class='login'")
 h.excludes("a forged session is not taken for a signed-in visitor", out, "signed in")
 
 -- The session cookie is Secure, so a form served over plain http would only
@@ -487,6 +488,7 @@ h.contains("over plain http the form says logging in needs https", out,
 	"<p class='login-error' role='alert'>Logging in only works over https.</p>")
 h.check("and is still there to fill in", way_back_in(out) ~= nil)
 out = run_action("body", {})
+h.contains("over https the form is shown", out, "<form class='login'")
 h.excludes("over https it says nothing of the kind", out, "only works over https")
 
 out = run_action("body", { url = "//evil.example/x" })
@@ -645,7 +647,8 @@ out = login("Alice", password, way_back)
 h.contains("an insecure session cookie keeps its plain name", out, "Set-Cookie: cgitauth=")
 h.excludes("and is not marked Secure", out, "; Secure")
 out = run_action("body", { https = "" })
-h.excludes("so its form does not ask for https", out, "only works over https")
+h.contains("so its form is shown over plain http", out, "<form class='login'")
+h.excludes("without asking for https", out, "only works over https")
 load_script()
 
 -- A cookie carries whole seconds, while on Lua 5.3 and later a session length