From 3358d99b1fc8dcb6d147349f9171231eb0032119 Mon Sep 17 00:00:00 2001 From: Bryce Kwon Date: Mon, 2 Nov 2026 20:22:52 -1000 Subject: Log failed logins The login posts outside any repository, so the log line names the repository by the page its signed way back leads to. --- tests/extensions/test-auth.lua | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'tests') diff --git a/tests/extensions/test-auth.lua b/tests/extensions/test-auth.lua index 73843ab..1fb9c21 100644 --- a/tests/extensions/test-auth.lua +++ b/tests/extensions/test-auth.lua @@ -337,11 +337,18 @@ h.contains("a good login redirects back", out, "Status: 302") h.contains("to where the form said", out, "Location: /repo/\n") local granted = out:match("Set%-Cookie: __Host%-cgitauth=([^;]*);") h.equals("and grants a session that verifies", granted and validate_value("username", granted, account_hash), "Alice") +h.equals("and logs nothing", h.error_log(), "") out = login("Alice", "wrong", way_back) h.contains("a bad password redirects the same way", out, "Status: 302") h.contains("back to the page with the failure flagged", out, "Location: /repo/?login=failed\n") h.contains("but clears the session cookie", out, "Set-Cookie: " .. session_name .. "=; ") +h.contains("and is logged with the name and the page", h.error_log(), + "[cgit] Failed login as Alice for /repo/\n") +h.excludes("but never with the password", h.error_log(), "wrong") +login("eve\r\n[cgit] Forged", "x", way_back) +h.contains("a name cannot forge a log line of its own", h.error_log(), + "[cgit] Failed login as eve[cgit] Forged for /repo/\n") -- A failed login for a name with no account spends crypt on a configured -- hash, the same work a real check costs, so timing tells nothing. -- cgit 2.12.1