git.iko.soy/typeable/oauth2-proxy
on 2bb7ea5 help sign in
typeable/oauth2-proxy/pkg/encryption/utils_test.go
148 lines 4.4 kB history raw
1package encryption
3import (
4 "crypto/rand"
5 "crypto/sha1"
6 "crypto/sha256"
7 "encoding/base64"
8 "fmt"
9 "io"
10 "net/http"
11 "strconv"
12 "strings"
13 "testing"
14 "time"
15 "unicode"
17 "github.com/stretchr/testify/assert"
20func TestSecretBytesEncoded(t *testing.T) {
21 for _, secretSize := range []int{16, 24, 32} {
22 t.Run(fmt.Sprintf("%d", secretSize), func(t *testing.T) {
23 secret := make([]byte, secretSize)
24 _, err := io.ReadFull(rand.Reader, secret)
25 assert.Equal(t, nil, err)
27 // We test both padded & raw Base64 to ensure we handle both
28 // potential user input routes for Base64
29 base64Padded := base64.URLEncoding.EncodeToString(secret)
30 sb := SecretBytes(base64Padded)
31 assert.Equal(t, secret, sb)
32 assert.Equal(t, len(sb), secretSize)
34 base64Raw := base64.RawURLEncoding.EncodeToString(secret)
35 sb = SecretBytes(base64Raw)
36 assert.Equal(t, secret, sb)
37 assert.Equal(t, len(sb), secretSize)
38 })
39 }
42// A string that isn't intended as Base64 and still decodes (but to unintended length)
43// will return the original secret as bytes
44func TestSecretBytesEncodedWrongSize(t *testing.T) {
45 for _, secretSize := range []int{15, 20, 28, 33, 44} {
46 t.Run(fmt.Sprintf("%d", secretSize), func(t *testing.T) {
47 secret := make([]byte, secretSize)
48 _, err := io.ReadFull(rand.Reader, secret)
49 assert.Equal(t, nil, err)
51 // We test both padded & raw Base64 to ensure we handle both
52 // potential user input routes for Base64
53 base64Padded := base64.URLEncoding.EncodeToString(secret)
54 sb := SecretBytes(base64Padded)
55 assert.NotEqual(t, secret, sb)
56 assert.NotEqual(t, len(sb), secretSize)
57 // The given secret is returned as []byte
58 assert.Equal(t, base64Padded, string(sb))
60 base64Raw := base64.RawURLEncoding.EncodeToString(secret)
61 sb = SecretBytes(base64Raw)
62 assert.NotEqual(t, secret, sb)
63 assert.NotEqual(t, len(sb), secretSize)
64 // The given secret is returned as []byte
65 assert.Equal(t, base64Raw, string(sb))
66 })
67 }
70func TestSecretBytesNonBase64(t *testing.T) {
71 trailer := "equals=========="
72 assert.Equal(t, trailer, string(SecretBytes(trailer)))
74 raw16 := "asdflkjhqwer)(*&"
75 sb16 := SecretBytes(raw16)
76 assert.Equal(t, raw16, string(sb16))
77 assert.Equal(t, 16, len(sb16))
79 raw24 := "asdflkjhqwer)(*&CJEN#$%^"
80 sb24 := SecretBytes(raw24)
81 assert.Equal(t, raw24, string(sb24))
82 assert.Equal(t, 24, len(sb24))
84 raw32 := "asdflkjhqwer)(*&1234lkjhqwer)(*&"
85 sb32 := SecretBytes(raw32)
86 assert.Equal(t, raw32, string(sb32))
87 assert.Equal(t, 32, len(sb32))
90func TestSignAndValidate(t *testing.T) {
91 seed := "0123456789abcdef"
92 key := "cookie-name"
93 value := base64.URLEncoding.EncodeToString([]byte("I am soooo encoded"))
94 epoch := "123456789"
96 sha256sig, err := cookieSignature(sha256.New, seed, key, value, epoch)
97 assert.NoError(t, err)
98 sha1sig, err := cookieSignature(sha1.New, seed, key, value, epoch)
99 assert.NoError(t, err)
101 assert.True(t, checkSignature(sha256sig, seed, key, value, epoch))
102 // We don't validate legacy SHA1 signatures anymore
103 assert.False(t, checkSignature(sha1sig, seed, key, value, epoch))
105 assert.False(t, checkSignature(sha256sig, seed, key, "tampered", epoch))
106 assert.False(t, checkSignature(sha1sig, seed, key, "tampered", epoch))
109func TestValidate(t *testing.T) {
110 seed := "0123456789abcdef"
111 key := "cookie-name"
112 value := base64.URLEncoding.EncodeToString([]byte("I am soooo encoded"))
113 epoch := int64(123456789)
114 epochStr := strconv.FormatInt(epoch, 10)
116 sha256sig, err := cookieSignature(sha256.New, seed, key, value, epochStr)
117 assert.NoError(t, err)
119 cookie := &http.Cookie{
120 Name: key,
121 Value: value + "|" + epochStr + "|" + sha256sig,
122 }
124 validValue, timestamp, ok := Validate(cookie, seed, 0)
125 assert.True(t, ok)
126 assert.Equal(t, timestamp, time.Unix(epoch, 0))
128 expectedValue, err := base64.URLEncoding.DecodeString(value)
129 assert.NoError(t, err)
130 assert.Equal(t, validValue, expectedValue)
133func TestGenerateRandomASCIIString(t *testing.T) {
134 randomString, err := GenerateRandomASCIIString(96)
135 assert.NoError(t, err)
137 // Only 8-bit characters
138 assert.Equal(t, 96, len([]byte(randomString)))
140 // All non-ascii characters removed should still be the original string
141 removedChars := strings.Map(func(r rune) rune {
142 if r > unicode.MaxASCII {
143 return -1
144 }
145 return r
146 }, randomString)
147 assert.Equal(t, removedChars, randomString)