From 6052c85118eda40b9f55e87718729748f9484652 Mon Sep 17 00:00:00 2001 From: Bryce Kwon Date: Sat, 31 Oct 2026 13:27:04 -0700 Subject: Take a signed cookie apart with one match The loop let a valid cookie through with a field appended, a doubled separator or a zero in front of its expiry. The payload now carries the expiry as written, so only the spelling secure_value issues verifies. --- tests/extensions/test-auth.lua | 1 + 1 file changed, 1 insertion(+) (limited to 'tests/extensions') diff --git a/tests/extensions/test-auth.lua b/tests/extensions/test-auth.lua index 742eabe..48c2add 100644 --- a/tests/extensions/test-auth.lua +++ b/tests/extensions/test-auth.lua @@ -192,6 +192,7 @@ h.equals("a value signed for one field does not serve another", validate_value(" h.equals("no cookie does not verify", validate_value("username", nil), nil) h.equals("a tiny cookie does not verify", validate_value("username", "ab"), nil) h.equals("a leading separator does not verify", validate_value("username", "|x|1|s|sig"), nil) +h.equals("a trailing field does not verify", validate_value("username", cookie .. "|x"), nil) h.equals("an unsigned cookie does not verify", validate_value("username", "username|alice|123|salt"), nil) h.equals("an exponent spelling of the expiry does not verify", -- cgit