58 lines
1.5 KiB
Go
58 lines
1.5 KiB
Go
package authproxy
|
|
|
|
import (
|
|
"encoding/base64"
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
func TestBoxRoundtrip(t *testing.T) {
|
|
b, err := newBox(strings.Repeat("s", 32))
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
in := stateClaims{Host: "app.example.com", RD: "/x?a=1&b=2", Proto: "https", Nonce: "n", Exp: 123}
|
|
tok, err := b.seal("state", in)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
var out stateClaims
|
|
if err := b.open("state", tok, &out); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if out != in {
|
|
t.Fatalf("roundtrip mismatch: %+v != %+v", out, in)
|
|
}
|
|
}
|
|
|
|
func TestBoxRejectsWrongPurpose(t *testing.T) {
|
|
b, _ := newBox(strings.Repeat("s", 32))
|
|
tok, _ := b.seal("state", stateClaims{Host: "a"})
|
|
var out stateClaims
|
|
if err := b.open("session", tok, &out); err == nil {
|
|
t.Fatal("expected purpose mismatch to fail")
|
|
}
|
|
}
|
|
|
|
func TestBoxRejectsTampering(t *testing.T) {
|
|
b, _ := newBox(strings.Repeat("s", 32))
|
|
tok, _ := b.seal("state", stateClaims{Host: "a"})
|
|
raw, _ := base64.RawURLEncoding.DecodeString(tok)
|
|
raw[len(raw)-1] ^= 0x01
|
|
tampered := base64.RawURLEncoding.EncodeToString(raw)
|
|
var out stateClaims
|
|
if err := b.open("state", tampered, &out); err == nil {
|
|
t.Fatal("expected tampered token to fail")
|
|
}
|
|
}
|
|
|
|
func TestBoxRejectsWrongKey(t *testing.T) {
|
|
b1, _ := newBox(strings.Repeat("a", 32))
|
|
b2, _ := newBox(strings.Repeat("b", 32))
|
|
tok, _ := b1.seal("state", stateClaims{Host: "a"})
|
|
var out stateClaims
|
|
if err := b2.open("state", tok, &out); err == nil {
|
|
t.Fatal("expected wrong key to fail")
|
|
}
|
|
}
|