git.iko.soy/typeable/oauth2-proxy
on proxy-mapping help sign in
typeable/oauth2-proxy/pkg/encryption/utils_test.go
102 lines 3.2 kB history raw
1package encryption
3import (
4 "crypto/rand"
5 "crypto/sha1"
6 "crypto/sha256"
7 "encoding/base64"
8 "fmt"
9 "io"
10 "testing"
12 "github.com/stretchr/testify/assert"
15func TestSecretBytesEncoded(t *testing.T) {
16 for _, secretSize := range []int{16, 24, 32} {
17 t.Run(fmt.Sprintf("%d", secretSize), func(t *testing.T) {
18 secret := make([]byte, secretSize)
19 _, err := io.ReadFull(rand.Reader, secret)
20 assert.Equal(t, nil, err)
22 // We test both padded & raw Base64 to ensure we handle both
23 // potential user input routes for Base64
24 base64Padded := base64.URLEncoding.EncodeToString(secret)
25 sb := SecretBytes(base64Padded)
26 assert.Equal(t, secret, sb)
27 assert.Equal(t, len(sb), secretSize)
29 base64Raw := base64.RawURLEncoding.EncodeToString(secret)
30 sb = SecretBytes(base64Raw)
31 assert.Equal(t, secret, sb)
32 assert.Equal(t, len(sb), secretSize)
33 })
34 }
37// A string that isn't intended as Base64 and still decodes (but to unintended length)
38// will return the original secret as bytes
39func TestSecretBytesEncodedWrongSize(t *testing.T) {
40 for _, secretSize := range []int{15, 20, 28, 33, 44} {
41 t.Run(fmt.Sprintf("%d", secretSize), func(t *testing.T) {
42 secret := make([]byte, secretSize)
43 _, err := io.ReadFull(rand.Reader, secret)
44 assert.Equal(t, nil, err)
46 // We test both padded & raw Base64 to ensure we handle both
47 // potential user input routes for Base64
48 base64Padded := base64.URLEncoding.EncodeToString(secret)
49 sb := SecretBytes(base64Padded)
50 assert.NotEqual(t, secret, sb)
51 assert.NotEqual(t, len(sb), secretSize)
52 // The given secret is returned as []byte
53 assert.Equal(t, base64Padded, string(sb))
55 base64Raw := base64.RawURLEncoding.EncodeToString(secret)
56 sb = SecretBytes(base64Raw)
57 assert.NotEqual(t, secret, sb)
58 assert.NotEqual(t, len(sb), secretSize)
59 // The given secret is returned as []byte
60 assert.Equal(t, base64Raw, string(sb))
61 })
62 }
65func TestSecretBytesNonBase64(t *testing.T) {
66 trailer := "equals=========="
67 assert.Equal(t, trailer, string(SecretBytes(trailer)))
69 raw16 := "asdflkjhqwer)(*&"
70 sb16 := SecretBytes(raw16)
71 assert.Equal(t, raw16, string(sb16))
72 assert.Equal(t, 16, len(sb16))
74 raw24 := "asdflkjhqwer)(*&CJEN#$%^"
75 sb24 := SecretBytes(raw24)
76 assert.Equal(t, raw24, string(sb24))
77 assert.Equal(t, 24, len(sb24))
79 raw32 := "asdflkjhqwer)(*&1234lkjhqwer)(*&"
80 sb32 := SecretBytes(raw32)
81 assert.Equal(t, raw32, string(sb32))
82 assert.Equal(t, 32, len(sb32))
85func TestSignAndValidate(t *testing.T) {
86 seed := "0123456789abcdef"
87 key := "cookie-name"
88 value := base64.URLEncoding.EncodeToString([]byte("I am soooo encoded"))
89 epoch := "123456789"
91 sha256sig, err := cookieSignature(sha256.New, seed, key, value, epoch)
92 assert.NoError(t, err)
93 sha1sig, err := cookieSignature(sha1.New, seed, key, value, epoch)
94 assert.NoError(t, err)
96 assert.True(t, checkSignature(sha256sig, seed, key, value, epoch))
97 // We don't validate legacy SHA1 signatures anymore
98 assert.False(t, checkSignature(sha1sig, seed, key, value, epoch))
100 assert.False(t, checkSignature(sha256sig, seed, key, "tampered", epoch))
101 assert.False(t, checkSignature(sha1sig, seed, key, "tampered", epoch))