2 files changed, 7 insertions, 1 deletion
diff --git a/tests/extensions/harness.lua b/tests/extensions/harness.lua
index 1a669ff..ead3c97 100644
--- a/tests/extensions/harness.lua
+++ b/tests/extensions/harness.lua
@@ -311,11 +311,14 @@ function harness.stub_auth_modules()
 			return table.concat(out)
 		end,
 	})
+	-- An HMAC-SHA256 is 32 bytes, twice what one fake digest gives, so two
+	-- of different input are joined to make signatures the real length.
 	preload("openssl.hmac", {
 		new = function(key, algorithm)
 			return {
 				final = function(self, payload)
-					return fake_digest_bytes(key .. "\1" .. algorithm .. "\1" .. payload)
+					local text = key .. "\1" .. algorithm .. "\1" .. payload
+					return fake_digest_bytes(text) .. fake_digest_bytes("\2" .. text)
 				end,
 			}
 		end,
diff --git a/tests/extensions/test-auth.lua b/tests/extensions/test-auth.lua
index d91287a..a7e1b70 100644
--- a/tests/extensions/test-auth.lua
+++ b/tests/extensions/test-auth.lua
@@ -292,6 +292,9 @@ local now = os.time()
 
 local cookie = secure_value("username", "alice", now + 3600)
 h.equals("a signed value verifies and comes back", validate_value("username", cookie), "alice")
+local signature = cookie:match("|(%x+)$")
+h.equals("its signature is a whole SHA-256 in hex", signature and #signature, 64)
+h.equals("each byte becomes two hex digits", tohex("\0\15\255"), "000fff")
 
 cookie = secure_value("username", "a|b", now + 3600)
 h.equals("a value holding the separator survives the round trip", validate_value("username", cookie), "a|b")
-rw-r--r--	tests/extensions/harness.lua	5
-rw-r--r--	tests/extensions/test-auth.lua	3