From bfc853cbb4ec8c7bb468a7e62fab36dc2b2185a7 Mon Sep 17 00:00:00 2001 From: Bryce Kwon Date: Sat, 7 Nov 2026 14:00:32 -1000 Subject: Check that a signature covers every cookie field The only tampering tried was a flipped signature, a field swapped for another and the binding, so a payload that left out the expiry, the salt or the value still passed, and a captured session could have been extended for ever. --- tests/extensions/test-auth.lua | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) (limited to 'tests/extensions/test-auth.lua') diff --git a/tests/extensions/test-auth.lua b/tests/extensions/test-auth.lua index 5faba1c..2234fac 100644 --- a/tests/extensions/test-auth.lua +++ b/tests/extensions/test-auth.lua @@ -265,6 +265,26 @@ h.equals("a tampered signature is rejected", validate_value("username", flipped) h.equals("a value signed for one field does not serve another", validate_value("redirect", cookie), nil) +-- The signature covers every field beside it, so none can be changed under +-- it. A later expiry would let a captured session run for ever. +local function with_field(token, index, replacement) + local fields = {} + for part in token:gmatch("[^|]+") do + fields[#fields + 1] = part + end + fields[index] = replacement + return table.concat(fields, "|") +end +h.equals("a cookie rebuilt unchanged still verifies", + validate_value("username", with_field(cookie, 1, "username")), "alice") +h.equals("a later expiry under the same signature does not", + validate_value("username", with_field(cookie, 3, tostring(now + 7200))), nil) +h.equals("nor does another salt", validate_value("username", with_field(cookie, 4, string.rep("0", 32))), nil) +h.equals("nor another name", validate_value("username", with_field(cookie, 2, "mallory")), nil) +local way_out = secure_value("redirect", "/repo/", 0) +h.equals("nor a way back pointed at another page", + validate_value("redirect", with_field(way_out, 2, url_encode("/other/"))), nil) + h.equals("no cookie does not verify", validate_value("username", nil), nil) h.equals("a tiny cookie does not verify", validate_value("username", "ab"), nil) h.equals("a leading separator does not verify", validate_value("username", "|x|1|s|sig"), nil) -- cgit 2.12.1