git.iko.soy/typeable/oauth2-proxy
on 71dc702 help sign in
typeable/oauth2-proxy/pkg/encryption/utils_test.go
100 lines 3.1 kB history raw
1package encryption
3import (
4 "crypto/rand"
5 "crypto/sha1"
6 "crypto/sha256"
7 "encoding/base64"
8 "fmt"
9 "io"
10 "testing"
12 "github.com/stretchr/testify/assert"
15func TestSecretBytesEncoded(t *testing.T) {
16 for _, secretSize := range []int{16, 24, 32} {
17 t.Run(fmt.Sprintf("%d", secretSize), func(t *testing.T) {
18 secret := make([]byte, secretSize)
19 _, err := io.ReadFull(rand.Reader, secret)
20 assert.Equal(t, nil, err)
22 // We test both padded & raw Base64 to ensure we handle both
23 // potential user input routes for Base64
24 base64Padded := base64.URLEncoding.EncodeToString(secret)
25 sb := SecretBytes(base64Padded)
26 assert.Equal(t, secret, sb)
27 assert.Equal(t, len(sb), secretSize)
29 base64Raw := base64.RawURLEncoding.EncodeToString(secret)
30 sb = SecretBytes(base64Raw)
31 assert.Equal(t, secret, sb)
32 assert.Equal(t, len(sb), secretSize)
33 })
34 }
37// A string that isn't intended as Base64 and still decodes (but to unintended length)
38// will return the original secret as bytes
39func TestSecretBytesEncodedWrongSize(t *testing.T) {
40 for _, secretSize := range []int{15, 20, 28, 33, 44} {
41 t.Run(fmt.Sprintf("%d", secretSize), func(t *testing.T) {
42 secret := make([]byte, secretSize)
43 _, err := io.ReadFull(rand.Reader, secret)
44 assert.Equal(t, nil, err)
46 // We test both padded & raw Base64 to ensure we handle both
47 // potential user input routes for Base64
48 base64Padded := base64.URLEncoding.EncodeToString(secret)
49 sb := SecretBytes(base64Padded)
50 assert.NotEqual(t, secret, sb)
51 assert.NotEqual(t, len(sb), secretSize)
52 // The given secret is returned as []byte
53 assert.Equal(t, base64Padded, string(sb))
55 base64Raw := base64.RawURLEncoding.EncodeToString(secret)
56 sb = SecretBytes(base64Raw)
57 assert.NotEqual(t, secret, sb)
58 assert.NotEqual(t, len(sb), secretSize)
59 // The given secret is returned as []byte
60 assert.Equal(t, base64Raw, string(sb))
61 })
62 }
65func TestSecretBytesNonBase64(t *testing.T) {
66 trailer := "equals=========="
67 assert.Equal(t, trailer, string(SecretBytes(trailer)))
69 raw16 := "asdflkjhqwer)(*&"
70 sb16 := SecretBytes(raw16)
71 assert.Equal(t, raw16, string(sb16))
72 assert.Equal(t, 16, len(sb16))
74 raw24 := "asdflkjhqwer)(*&CJEN#$%^"
75 sb24 := SecretBytes(raw24)
76 assert.Equal(t, raw24, string(sb24))
77 assert.Equal(t, 24, len(sb24))
79 raw32 := "asdflkjhqwer)(*&1234lkjhqwer)(*&"
80 sb32 := SecretBytes(raw32)
81 assert.Equal(t, raw32, string(sb32))
82 assert.Equal(t, 32, len(sb32))
85func TestSignAndValidate(t *testing.T) {
86 seed := "0123456789abcdef"
87 key := "cookie-name"
88 value := base64.URLEncoding.EncodeToString([]byte("I am soooo encoded"))
89 epoch := "123456789"
91 sha256sig := cookieSignature(sha256.New, seed, key, value, epoch)
92 sha1sig := cookieSignature(sha1.New, seed, key, value, epoch)
94 assert.True(t, checkSignature(sha256sig, seed, key, value, epoch))
95 // This should be switched to False after fully deprecating SHA1
96 assert.True(t, checkSignature(sha1sig, seed, key, value, epoch))
98 assert.False(t, checkSignature(sha256sig, seed, key, "tampered", epoch))
99 assert.False(t, checkSignature(sha1sig, seed, key, "tampered", epoch))