1 file changed, 12 insertions, 1 deletion
diff --git a/tests/extensions/test-auth.lua b/tests/extensions/test-auth.lua
index db97bb3..73843ab 100644
--- a/tests/extensions/test-auth.lua
+++ b/tests/extensions/test-auth.lua
@@ -228,7 +228,7 @@ local function run_action(action, opts)
 	opts = opts or {}
 	h.reset()
 	filter_open(action, opts.cookie or "", opts.method or "GET", "", "",
-		"/", "example.org", "on", opts.repo or "", "summary",
+		"/", "example.org", opts.https or "on", opts.repo or "", "summary",
 		opts.url or "/repo/", "/?p=login")
 	if opts.body then
 		filter_write(opts.body)
@@ -300,6 +300,15 @@ h.check("and can still sign in as someone else", way_back_in(out) ~= nil)
 out = run_action("body", { cookie = session_name .. "=" .. forged })
 h.excludes("a forged session is not taken for a signed-in visitor", out, "signed in")
 
+-- The session cookie is Secure, so a form served over plain http would only
+-- come round again after every login.
+out = run_action("body", { https = "" })
+h.contains("over plain http the form says logging in needs https", out,
+	"<p class='login-error' role='alert'>Logging in only works over https.</p>")
+h.check("and is still there to fill in", way_back_in(out) ~= nil)
+out = run_action("body", {})
+h.excludes("over https it says nothing of the kind", out, "only works over https")
+
 out = run_action("body", { url = "//evil.example/x" })
 h.equals("an unsafe destination is swapped for the login page", way_back_in(out), "/?p=login")
 h.equals("and is not taken for a failed login", out:find("login-error", 1, true), nil)
@@ -370,6 +379,8 @@ load_script({ { "local cookie_insecure = false", "local cookie_insecure = true"
 out = login("Alice", password, way_back)
 h.contains("an insecure session cookie keeps its plain name", out, "Set-Cookie: cgitauth=")
 h.excludes("and is not marked Secure", out, "; Secure")
+out = run_action("body", { https = "" })
+h.excludes("so its form does not ask for https", out, "only works over https")
 load_script()
 
 -- A cookie carries whole seconds, while on Lua 5.3 and later a session length