From f6cb13a22932422fa55041891eb96db098b6c18a Mon Sep 17 00:00:00 2001 From: Bryce Kwon Date: Sat, 7 Nov 2026 14:22:38 -1000 Subject: Sign the malformed cookies the checks refuse The exponent and leading separator cases carried a made-up signature, which fails the check whatever the parsing does, so loosening the expiry pattern or dropping its start anchor passed. Both are now built from properly signed tokens. --- tests/extensions/test-auth.lua | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'tests/extensions') diff --git a/tests/extensions/test-auth.lua b/tests/extensions/test-auth.lua index 1531040..17cb805 100644 --- a/tests/extensions/test-auth.lua +++ b/tests/extensions/test-auth.lua @@ -332,12 +332,12 @@ h.equals("nor a way back pointed at another page", h.equals("no cookie does not verify", validate_value("username", nil), nil) h.equals("a tiny cookie does not verify", validate_value("username", "ab"), nil) -h.equals("a leading separator does not verify", validate_value("username", "|x|1|s|sig"), nil) +h.equals("a leading separator does not verify", validate_value("username", "|" .. cookie), nil) h.equals("a trailing field does not verify", validate_value("username", cookie .. "|x"), nil) h.equals("an unsigned cookie does not verify", validate_value("username", "username|alice|123|salt"), nil) -h.equals("an exponent spelling of the expiry does not verify", - validate_value("username", "username|alice|1e9|salt|beef"), nil) +h.equals("an exponent spelling of the expiry does not verify, even signed", + validate_value("username", secure_value("username", "alice", "1e10")), nil) h.equals("an empty value signs to nothing", secure_value("username", "", 1), "") -- The headers the filter writes itself. -- cgit 2.12.1