From 5f70e0f964e557aa330ceea9a70bcc0b80ca55e5 Mon Sep 17 00:00:00 2001 From: Bryce Kwon Date: Sat, 7 Nov 2026 15:02:59 -1000 Subject: Check expired and planted sessions on a visit An expired session was only tried against validate_value, never sent through a visit, and nothing sent a session under the plain cookie name, which a sibling subdomain can set where it cannot set the __Host- one. --- tests/extensions/test-auth.lua | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/tests/extensions/test-auth.lua b/tests/extensions/test-auth.lua index e52b406..822a075 100644 --- a/tests/extensions/test-auth.lua +++ b/tests/extensions/test-auth.lua @@ -448,6 +448,13 @@ h.equals("while one in the second group lets them in", visit("both-repo", outsid local forged = session:sub(1, -2) .. (session:sub(-1) == "0" and "1" or "0") h.equals("a forged session is turned away", visit("secret-repo", forged), 0) +local expired = secure_value("username", "Alice", now - 10, stored_hash) +h.equals("an expired session is turned away", visit("secret-repo", expired), 0) + +-- Only the __Host- name is safe from a cookie a sibling subdomain planted. +local _, planted = run_action("authenticate-cookie", { repo = "secret-repo", cookie = "cgitauth=" .. session }) +h.equals("a session under the plain cookie name is turned away", planted, 0) + -- Only the secret keeps a visitor from signing a session of their own, so -- one signed under any other secret is worthless. local real_get_secret = get_secret -- cgit 2.12.1