Diff options
Diffstat (limited to 'tests/extensions/test-auth.lua')
| -rw-r--r-- | tests/extensions/test-auth.lua | 20 |
1 file changed, 20 insertions, 0 deletions
diff --git a/tests/extensions/test-auth.lua b/tests/extensions/test-auth.lua index 5faba1c..2234fac 100644 --- a/tests/extensions/test-auth.lua +++ b/tests/extensions/test-auth.lua @@ -265,6 +265,26 @@ h.equals("a tampered signature is rejected", validate_value("username", flipped) h.equals("a value signed for one field does not serve another", validate_value("redirect", cookie), nil) +-- The signature covers every field beside it, so none can be changed under +-- it. A later expiry would let a captured session run for ever. +local function with_field(token, index, replacement) + local fields = {} + for part in token:gmatch("[^|]+") do + fields[#fields + 1] = part + end + fields[index] = replacement + return table.concat(fields, "|") +end +h.equals("a cookie rebuilt unchanged still verifies", + validate_value("username", with_field(cookie, 1, "username")), "alice") +h.equals("a later expiry under the same signature does not", + validate_value("username", with_field(cookie, 3, tostring(now + 7200))), nil) +h.equals("nor does another salt", validate_value("username", with_field(cookie, 4, string.rep("0", 32))), nil) +h.equals("nor another name", validate_value("username", with_field(cookie, 2, "mallory")), nil) +local way_out = secure_value("redirect", "/repo/", 0) +h.equals("nor a way back pointed at another page", + validate_value("redirect", with_field(way_out, 2, url_encode("/other/"))), nil) + h.equals("no cookie does not verify", validate_value("username", nil), nil) h.equals("a tiny cookie does not verify", validate_value("username", "ab"), nil) h.equals("a leading separator does not verify", validate_value("username", "|x|1|s|sig"), nil) |