From 95c8a8f984855ea68e979666601d29b70a1f2553 Mon Sep 17 00:00:00 2001 From: Bryce Kwon Date: Sat, 7 Nov 2026 15:07:16 -1000 Subject: Hold signatures to the length SHA-256 gives The fake HMAC returned 16 bytes, so the checks signed with signatures half the real length, and a signature cut short passed. tohex's output was never pinned either, so dropping its zero padding stayed consistent with itself and passed. --- tests/extensions/test-auth.lua | 3 +++ 1 file changed, 3 insertions(+) (limited to 'tests/extensions/test-auth.lua') diff --git a/tests/extensions/test-auth.lua b/tests/extensions/test-auth.lua index d91287a..a7e1b70 100644 --- a/tests/extensions/test-auth.lua +++ b/tests/extensions/test-auth.lua @@ -292,6 +292,9 @@ local now = os.time() local cookie = secure_value("username", "alice", now + 3600) h.equals("a signed value verifies and comes back", validate_value("username", cookie), "alice") +local signature = cookie:match("|(%x+)$") +h.equals("its signature is a whole SHA-256 in hex", signature and #signature, 64) +h.equals("each byte becomes two hex digits", tohex("\0\15\255"), "000fff") cookie = secure_value("username", "a|b", now + 3600) h.equals("a value holding the separator survives the round trip", validate_value("username", cookie), "a|b") -- cgit 2.12.1