From bc5bf45b8705055ced72ea33e2f736232355b0ec Mon Sep 17 00:00:00 2001 From: Bryce Kwon Date: Sat, 7 Nov 2026 13:59:04 -1000 Subject: Check that the secret keys every signature Every check signed and verified under one pinned secret, so a sign() that left the secret out of the HMAC key, which makes every cookie forgeable, passed. --- tests/extensions/test-auth.lua | 12 ++++++++++++ 1 file changed, 12 insertions(+) (limited to 'tests/extensions/test-auth.lua') diff --git a/tests/extensions/test-auth.lua b/tests/extensions/test-auth.lua index 506babf..5faba1c 100644 --- a/tests/extensions/test-auth.lua +++ b/tests/extensions/test-auth.lua @@ -362,6 +362,18 @@ h.equals("a signed session for an outsider is turned away", visit("secret-repo", local forged = session:sub(1, -2) .. (session:sub(-1) == "0" and "1" or "0") h.equals("a forged session is turned away", visit("secret-repo", forged), 0) +-- Only the secret keeps a visitor from signing a session of their own, so +-- one signed under any other secret is worthless. +local real_get_secret = get_secret +get_secret = function() + return string.rep("fedcba9876543210", 4) +end +h.equals("a session signed under another secret does not verify", + validate_value("username", session, account_hash), nil) +h.equals("and lets nobody in", visit("secret-repo", session), 0) +get_secret = real_get_secret +h.equals("while under its own secret it still does", visit("secret-repo", session), 1) + local _, ret = run_action("no-such-action", {}) h.equals("an unknown action denies rather than raising", ret, 0) -- cgit 2.12.1