Christophe Vila
0e3295b746
Corrupting the true last character of a JWT's base64url-encoded HMAC-SHA256 signature is unreliable: that character encodes only 4 real bits plus 2 unused padding bits, and Go's encoding/base64 ignores those padding bits by default -- about 1 in 4 replacement characters decode to byte-identical signature bytes, so the "tampered" cookie still verifies and the test spuriously passes. Corrupting the second-to-last character instead is deterministic, since HMAC-SHA256's fixed 32-byte digest length means that position is always fully significant. Confirmed via 20 repeated runs (previously ~1/3 failure rate). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
75 lines
2.2 KiB
Go
75 lines
2.2 KiB
Go
package auth
|
|
|
|
import (
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"testing"
|
|
"time"
|
|
)
|
|
|
|
func protectedTestHandler() http.Handler {
|
|
return RequireSession([]byte(testSecret))(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
claims, ok := ClaimsFromContext(r.Context())
|
|
if !ok {
|
|
http.Error(w, "no claims in context", http.StatusInternalServerError)
|
|
return
|
|
}
|
|
w.Write([]byte(claims.Name))
|
|
}))
|
|
}
|
|
|
|
func TestRequireSession_NoCookie(t *testing.T) {
|
|
req := httptest.NewRequest(http.MethodGet, "/", nil)
|
|
rec := httptest.NewRecorder()
|
|
protectedTestHandler().ServeHTTP(rec, req)
|
|
if rec.Code != http.StatusUnauthorized {
|
|
t.Fatalf("status = %d, want 401", rec.Code)
|
|
}
|
|
}
|
|
|
|
func TestRequireSession_ValidCookie(t *testing.T) {
|
|
cookie, err := MintSessionCookie(Claims{Sub: "u1", Name: "Alice", Email: "alice@example.com"}, []byte(testSecret), time.Hour, false)
|
|
if err != nil {
|
|
t.Fatalf("mint: %v", err)
|
|
}
|
|
req := httptest.NewRequest(http.MethodGet, "/", nil)
|
|
req.AddCookie(cookie)
|
|
rec := httptest.NewRecorder()
|
|
protectedTestHandler().ServeHTTP(rec, req)
|
|
if rec.Code != http.StatusOK {
|
|
t.Fatalf("status = %d, want 200, body = %s", rec.Code, rec.Body.String())
|
|
}
|
|
if rec.Body.String() != "Alice" {
|
|
t.Fatalf("body = %q, want Alice", rec.Body.String())
|
|
}
|
|
}
|
|
|
|
func TestRequireSession_ExpiredCookie(t *testing.T) {
|
|
cookie, err := MintSessionCookie(Claims{Sub: "u1"}, []byte(testSecret), -time.Hour, false)
|
|
if err != nil {
|
|
t.Fatalf("mint: %v", err)
|
|
}
|
|
req := httptest.NewRequest(http.MethodGet, "/", nil)
|
|
req.AddCookie(cookie)
|
|
rec := httptest.NewRecorder()
|
|
protectedTestHandler().ServeHTTP(rec, req)
|
|
if rec.Code != http.StatusUnauthorized {
|
|
t.Fatalf("status = %d, want 401", rec.Code)
|
|
}
|
|
}
|
|
|
|
func TestRequireSession_TamperedCookie(t *testing.T) {
|
|
cookie, err := MintSessionCookie(Claims{Sub: "u1"}, []byte(testSecret), time.Hour, false)
|
|
if err != nil {
|
|
t.Fatalf("mint: %v", err)
|
|
}
|
|
cookie.Value = flipSignatureChar(cookie.Value)
|
|
req := httptest.NewRequest(http.MethodGet, "/", nil)
|
|
req.AddCookie(cookie)
|
|
rec := httptest.NewRecorder()
|
|
protectedTestHandler().ServeHTTP(rec, req)
|
|
if rec.Code != http.StatusUnauthorized {
|
|
t.Fatalf("status = %d, want 401", rec.Code)
|
|
}
|
|
}
|