git.iko.soy/typeable/oauth2-proxy
on v2.1 help sign in
typeable/oauth2-proxy/oauthproxy_test.go
736 lines 22 kB history raw
1package main
3import (
4 "crypto"
5 "encoding/base64"
6 "github.com/18F/hmacauth"
7 "github.com/bitly/oauth2_proxy/providers"
8 "github.com/bmizerany/assert"
9 "io"
10 "io/ioutil"
11 "log"
12 "net"
13 "net/http"
14 "net/http/httptest"
15 "net/url"
16 "regexp"
17 "strings"
18 "testing"
19 "time"
22func init() {
23 log.SetFlags(log.Ldate | log.Ltime | log.Lshortfile)
27func TestNewReverseProxy(t *testing.T) {
28 backend := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
29 w.WriteHeader(200)
30 hostname, _, _ := net.SplitHostPort(r.Host)
31 w.Write([]byte(hostname))
32 }))
33 defer backend.Close()
35 backendURL, _ := url.Parse(backend.URL)
36 backendHostname, backendPort, _ := net.SplitHostPort(backendURL.Host)
37 backendHost := net.JoinHostPort(backendHostname, backendPort)
38 proxyURL, _ := url.Parse(backendURL.Scheme + "://" + backendHost + "/")
40 proxyHandler := NewReverseProxy(proxyURL)
41 setProxyUpstreamHostHeader(proxyHandler, proxyURL)
42 frontend := httptest.NewServer(proxyHandler)
43 defer frontend.Close()
45 getReq, _ := http.NewRequest("GET", frontend.URL, nil)
46 res, _ := http.DefaultClient.Do(getReq)
47 bodyBytes, _ := ioutil.ReadAll(res.Body)
48 if g, e := string(bodyBytes), backendHostname; g != e {
49 t.Errorf("got body %q; expected %q", g, e)
50 }
53func TestEncodedSlashes(t *testing.T) {
54 var seen string
55 backend := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
56 w.WriteHeader(200)
57 seen = r.RequestURI
58 }))
59 defer backend.Close()
61 b, _ := url.Parse(backend.URL)
62 proxyHandler := NewReverseProxy(b)
63 setProxyDirector(proxyHandler)
64 frontend := httptest.NewServer(proxyHandler)
65 defer frontend.Close()
67 f, _ := url.Parse(frontend.URL)
68 encodedPath := "/a%2Fb/?c=1"
69 getReq := &http.Request{URL: &url.URL{Scheme: "http", Host: f.Host, Opaque: encodedPath}}
70 _, err := http.DefaultClient.Do(getReq)
71 if err != nil {
72 t.Fatalf("err %s", err)
73 }
74 if seen != encodedPath {
75 t.Errorf("got bad request %q expected %q", seen, encodedPath)
76 }
79func TestRobotsTxt(t *testing.T) {
80 opts := NewOptions()
81 opts.ClientID = "bazquux"
82 opts.ClientSecret = "foobar"
83 opts.CookieSecret = "xyzzyplugh"
84 opts.Validate()
86 proxy := NewOAuthProxy(opts, func(string) bool { return true })
87 rw := httptest.NewRecorder()
88 req, _ := http.NewRequest("GET", "/robots.txt", nil)
89 proxy.ServeHTTP(rw, req)
90 assert.Equal(t, 200, rw.Code)
91 assert.Equal(t, "User-agent: *\nDisallow: /", rw.Body.String())
94type TestProvider struct {
95 *providers.ProviderData
96 EmailAddress string
97 ValidToken bool
100func NewTestProvider(provider_url *url.URL, email_address string) *TestProvider {
101 return &TestProvider{
102 ProviderData: &providers.ProviderData{
103 ProviderName: "Test Provider",
104 LoginURL: &url.URL{
105 Scheme: "http",
106 Host: provider_url.Host,
107 Path: "/oauth/authorize",
108 },
109 RedeemURL: &url.URL{
110 Scheme: "http",
111 Host: provider_url.Host,
112 Path: "/oauth/token",
113 },
114 ProfileURL: &url.URL{
115 Scheme: "http",
116 Host: provider_url.Host,
117 Path: "/api/v1/profile",
118 },
119 Scope: "profile.email",
120 },
121 EmailAddress: email_address,
122 }
125func (tp *TestProvider) GetEmailAddress(session *providers.SessionState) (string, error) {
126 return tp.EmailAddress, nil
129func (tp *TestProvider) ValidateSessionState(session *providers.SessionState) bool {
130 return tp.ValidToken
133func TestBasicAuthPassword(t *testing.T) {
134 provider_server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
135 log.Printf("%#v", r)
136 url := r.URL
137 payload := ""
138 switch url.Path {
139 case "/oauth/token":
140 payload = `{"access_token": "my_auth_token"}`
141 default:
142 payload = r.Header.Get("Authorization")
143 if payload == "" {
144 payload = "No Authorization header found."
145 }
146 }
147 w.WriteHeader(200)
148 w.Write([]byte(payload))
149 }))
150 opts := NewOptions()
151 opts.Upstreams = append(opts.Upstreams, provider_server.URL)
152 // The CookieSecret must be 32 bytes in order to create the AES
153 // cipher.
154 opts.CookieSecret = "xyzzyplughxyzzyplughxyzzyplughxp"
155 opts.ClientID = "bazquux"
156 opts.ClientSecret = "foobar"
157 opts.CookieSecure = false
158 opts.PassBasicAuth = true
159 opts.BasicAuthPassword = "This is a secure password"
160 opts.Validate()
162 provider_url, _ := url.Parse(provider_server.URL)
163 const email_address = "michael.bland@gsa.gov"
164 const user_name = "michael.bland"
166 opts.provider = NewTestProvider(provider_url, email_address)
167 proxy := NewOAuthProxy(opts, func(email string) bool {
168 return email == email_address
169 })
171 rw := httptest.NewRecorder()
172 req, _ := http.NewRequest("GET", "/oauth2/callback?code=callback_code",
173 strings.NewReader(""))
174 proxy.ServeHTTP(rw, req)
175 cookie := rw.HeaderMap["Set-Cookie"][0]
177 cookieName := proxy.CookieName
178 var value string
179 key_prefix := cookieName + "="
181 for _, field := range strings.Split(cookie, "; ") {
182 value = strings.TrimPrefix(field, key_prefix)
183 if value != field {
184 break
185 } else {
186 value = ""
187 }
188 }
190 req, _ = http.NewRequest("GET", "/", strings.NewReader(""))
191 req.AddCookie(&http.Cookie{
192 Name: cookieName,
193 Value: value,
194 Path: "/",
195 Expires: time.Now().Add(time.Duration(24)),
196 HttpOnly: true,
197 })
199 rw = httptest.NewRecorder()
200 proxy.ServeHTTP(rw, req)
201 expectedHeader := "Basic " + base64.StdEncoding.EncodeToString([]byte(user_name+":"+opts.BasicAuthPassword))
202 assert.Equal(t, expectedHeader, rw.Body.String())
203 provider_server.Close()
206type PassAccessTokenTest struct {
207 provider_server *httptest.Server
208 proxy *OAuthProxy
209 opts *Options
212type PassAccessTokenTestOptions struct {
213 PassAccessToken bool
216func NewPassAccessTokenTest(opts PassAccessTokenTestOptions) *PassAccessTokenTest {
217 t := &PassAccessTokenTest{}
219 t.provider_server = httptest.NewServer(
220 http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
221 log.Printf("%#v", r)
222 url := r.URL
223 payload := ""
224 switch url.Path {
225 case "/oauth/token":
226 payload = `{"access_token": "my_auth_token"}`
227 default:
228 payload = r.Header.Get("X-Forwarded-Access-Token")
229 if payload == "" {
230 payload = "No access token found."
231 }
232 }
233 w.WriteHeader(200)
234 w.Write([]byte(payload))
235 }))
237 t.opts = NewOptions()
238 t.opts.Upstreams = append(t.opts.Upstreams, t.provider_server.URL)
239 // The CookieSecret must be 32 bytes in order to create the AES
240 // cipher.
241 t.opts.CookieSecret = "xyzzyplughxyzzyplughxyzzyplughxp"
242 t.opts.ClientID = "bazquux"
243 t.opts.ClientSecret = "foobar"
244 t.opts.CookieSecure = false
245 t.opts.PassAccessToken = opts.PassAccessToken
246 t.opts.Validate()
248 provider_url, _ := url.Parse(t.provider_server.URL)
249 const email_address = "michael.bland@gsa.gov"
251 t.opts.provider = NewTestProvider(provider_url, email_address)
252 t.proxy = NewOAuthProxy(t.opts, func(email string) bool {
253 return email == email_address
254 })
255 return t
258func (pat_test *PassAccessTokenTest) Close() {
259 pat_test.provider_server.Close()
262func (pat_test *PassAccessTokenTest) getCallbackEndpoint() (http_code int,
263 cookie string) {
264 rw := httptest.NewRecorder()
265 req, err := http.NewRequest("GET", "/oauth2/callback?code=callback_code",
266 strings.NewReader(""))
267 if err != nil {
268 return 0, ""
269 }
270 pat_test.proxy.ServeHTTP(rw, req)
271 return rw.Code, rw.HeaderMap["Set-Cookie"][0]
274func (pat_test *PassAccessTokenTest) getRootEndpoint(cookie string) (http_code int, access_token string) {
275 cookieName := pat_test.proxy.CookieName
276 var value string
277 key_prefix := cookieName + "="
279 for _, field := range strings.Split(cookie, "; ") {
280 value = strings.TrimPrefix(field, key_prefix)
281 if value != field {
282 break
283 } else {
284 value = ""
285 }
286 }
287 if value == "" {
288 return 0, ""
289 }
291 req, err := http.NewRequest("GET", "/", strings.NewReader(""))
292 if err != nil {
293 return 0, ""
294 }
295 req.AddCookie(&http.Cookie{
296 Name: cookieName,
297 Value: value,
298 Path: "/",
299 Expires: time.Now().Add(time.Duration(24)),
300 HttpOnly: true,
301 })
303 rw := httptest.NewRecorder()
304 pat_test.proxy.ServeHTTP(rw, req)
305 return rw.Code, rw.Body.String()
308func TestForwardAccessTokenUpstream(t *testing.T) {
309 pat_test := NewPassAccessTokenTest(PassAccessTokenTestOptions{
310 PassAccessToken: true,
311 })
312 defer pat_test.Close()
314 // A successful validation will redirect and set the auth cookie.
315 code, cookie := pat_test.getCallbackEndpoint()
316 assert.Equal(t, 302, code)
317 assert.NotEqual(t, nil, cookie)
319 // Now we make a regular request; the access_token from the cookie is
320 // forwarded as the "X-Forwarded-Access-Token" header. The token is
321 // read by the test provider server and written in the response body.
322 code, payload := pat_test.getRootEndpoint(cookie)
323 assert.Equal(t, 200, code)
324 assert.Equal(t, "my_auth_token", payload)
327func TestDoNotForwardAccessTokenUpstream(t *testing.T) {
328 pat_test := NewPassAccessTokenTest(PassAccessTokenTestOptions{
329 PassAccessToken: false,
330 })
331 defer pat_test.Close()
333 // A successful validation will redirect and set the auth cookie.
334 code, cookie := pat_test.getCallbackEndpoint()
335 assert.Equal(t, 302, code)
336 assert.NotEqual(t, nil, cookie)
338 // Now we make a regular request, but the access token header should
339 // not be present.
340 code, payload := pat_test.getRootEndpoint(cookie)
341 assert.Equal(t, 200, code)
342 assert.Equal(t, "No access token found.", payload)
345type SignInPageTest struct {
346 opts *Options
347 proxy *OAuthProxy
348 sign_in_regexp *regexp.Regexp
351const signInRedirectPattern = `<input type="hidden" name="rd" value="(.*)">`
353func NewSignInPageTest() *SignInPageTest {
354 var sip_test SignInPageTest
356 sip_test.opts = NewOptions()
357 sip_test.opts.CookieSecret = "foobar"
358 sip_test.opts.ClientID = "bazquux"
359 sip_test.opts.ClientSecret = "xyzzyplugh"
360 sip_test.opts.Validate()
362 sip_test.proxy = NewOAuthProxy(sip_test.opts, func(email string) bool {
363 return true
364 })
365 sip_test.sign_in_regexp = regexp.MustCompile(signInRedirectPattern)
367 return &sip_test
370func (sip_test *SignInPageTest) GetEndpoint(endpoint string) (int, string) {
371 rw := httptest.NewRecorder()
372 req, _ := http.NewRequest("GET", endpoint, strings.NewReader(""))
373 sip_test.proxy.ServeHTTP(rw, req)
374 return rw.Code, rw.Body.String()
377func TestSignInPageIncludesTargetRedirect(t *testing.T) {
378 sip_test := NewSignInPageTest()
379 const endpoint = "/some/random/endpoint"
381 code, body := sip_test.GetEndpoint(endpoint)
382 assert.Equal(t, 403, code)
384 match := sip_test.sign_in_regexp.FindStringSubmatch(body)
385 if match == nil {
386 t.Fatal("Did not find pattern in body: " +
387 signInRedirectPattern + "\nBody:\n" + body)
388 }
389 if match[1] != endpoint {
390 t.Fatal(`expected redirect to "` + endpoint +
391 `", but was "` + match[1] + `"`)
392 }
395func TestSignInPageDirectAccessRedirectsToRoot(t *testing.T) {
396 sip_test := NewSignInPageTest()
397 code, body := sip_test.GetEndpoint("/oauth2/sign_in")
398 assert.Equal(t, 200, code)
400 match := sip_test.sign_in_regexp.FindStringSubmatch(body)
401 if match == nil {
402 t.Fatal("Did not find pattern in body: " +
403 signInRedirectPattern + "\nBody:\n" + body)
404 }
405 if match[1] != "/" {
406 t.Fatal(`expected redirect to "/", but was "` + match[1] + `"`)
407 }
410type ProcessCookieTest struct {
411 opts *Options
412 proxy *OAuthProxy
413 rw *httptest.ResponseRecorder
414 req *http.Request
415 provider TestProvider
416 response_code int
417 validate_user bool
420type ProcessCookieTestOpts struct {
421 provider_validate_cookie_response bool
424func NewProcessCookieTest(opts ProcessCookieTestOpts) *ProcessCookieTest {
425 var pc_test ProcessCookieTest
427 pc_test.opts = NewOptions()
428 pc_test.opts.ClientID = "bazquux"
429 pc_test.opts.ClientSecret = "xyzzyplugh"
430 pc_test.opts.CookieSecret = "0123456789abcdefabcd"
431 // First, set the CookieRefresh option so proxy.AesCipher is created,
432 // needed to encrypt the access_token.
433 pc_test.opts.CookieRefresh = time.Hour
434 pc_test.opts.Validate()
436 pc_test.proxy = NewOAuthProxy(pc_test.opts, func(email string) bool {
437 return pc_test.validate_user
438 })
439 pc_test.proxy.provider = &TestProvider{
440 ValidToken: opts.provider_validate_cookie_response,
441 }
443 // Now, zero-out proxy.CookieRefresh for the cases that don't involve
444 // access_token validation.
445 pc_test.proxy.CookieRefresh = time.Duration(0)
446 pc_test.rw = httptest.NewRecorder()
447 pc_test.req, _ = http.NewRequest("GET", "/", strings.NewReader(""))
448 pc_test.validate_user = true
449 return &pc_test
452func NewProcessCookieTestWithDefaults() *ProcessCookieTest {
453 return NewProcessCookieTest(ProcessCookieTestOpts{
454 provider_validate_cookie_response: true,
455 })
458func (p *ProcessCookieTest) MakeCookie(value string, ref time.Time) *http.Cookie {
459 return p.proxy.MakeCookie(p.req, value, p.opts.CookieExpire, ref)
462func (p *ProcessCookieTest) SaveSession(s *providers.SessionState, ref time.Time) error {
463 value, err := p.proxy.provider.CookieForSession(s, p.proxy.CookieCipher)
464 if err != nil {
465 return err
466 }
467 p.req.AddCookie(p.proxy.MakeCookie(p.req, value, p.proxy.CookieExpire, ref))
468 return nil
471func (p *ProcessCookieTest) LoadCookiedSession() (*providers.SessionState, time.Duration, error) {
472 return p.proxy.LoadCookiedSession(p.req)
475func TestLoadCookiedSession(t *testing.T) {
476 pc_test := NewProcessCookieTestWithDefaults()
478 startSession := &providers.SessionState{Email: "michael.bland@gsa.gov", AccessToken: "my_access_token"}
479 pc_test.SaveSession(startSession, time.Now())
481 session, _, err := pc_test.LoadCookiedSession()
482 assert.Equal(t, nil, err)
483 assert.Equal(t, startSession.Email, session.Email)
484 assert.Equal(t, "michael.bland", session.User)
485 assert.Equal(t, startSession.AccessToken, session.AccessToken)
488func TestProcessCookieNoCookieError(t *testing.T) {
489 pc_test := NewProcessCookieTestWithDefaults()
491 session, _, err := pc_test.LoadCookiedSession()
492 assert.Equal(t, "Cookie \"_oauth2_proxy\" not present", err.Error())
493 if session != nil {
494 t.Errorf("expected nil session. got %#v", session)
495 }
498func TestProcessCookieRefreshNotSet(t *testing.T) {
499 pc_test := NewProcessCookieTestWithDefaults()
500 pc_test.proxy.CookieExpire = time.Duration(23) * time.Hour
501 reference := time.Now().Add(time.Duration(-2) * time.Hour)
503 startSession := &providers.SessionState{Email: "michael.bland@gsa.gov", AccessToken: "my_access_token"}
504 pc_test.SaveSession(startSession, reference)
506 session, age, err := pc_test.LoadCookiedSession()
507 assert.Equal(t, nil, err)
508 if age < time.Duration(-2)*time.Hour {
509 t.Errorf("cookie too young %v", age)
510 }
511 assert.Equal(t, startSession.Email, session.Email)
514func TestProcessCookieFailIfCookieExpired(t *testing.T) {
515 pc_test := NewProcessCookieTestWithDefaults()
516 pc_test.proxy.CookieExpire = time.Duration(24) * time.Hour
517 reference := time.Now().Add(time.Duration(25) * time.Hour * -1)
518 startSession := &providers.SessionState{Email: "michael.bland@gsa.gov", AccessToken: "my_access_token"}
519 pc_test.SaveSession(startSession, reference)
521 session, _, err := pc_test.LoadCookiedSession()
522 assert.NotEqual(t, nil, err)
523 if session != nil {
524 t.Errorf("expected nil session %#v", session)
525 }
528func TestProcessCookieFailIfRefreshSetAndCookieExpired(t *testing.T) {
529 pc_test := NewProcessCookieTestWithDefaults()
530 pc_test.proxy.CookieExpire = time.Duration(24) * time.Hour
531 reference := time.Now().Add(time.Duration(25) * time.Hour * -1)
532 startSession := &providers.SessionState{Email: "michael.bland@gsa.gov", AccessToken: "my_access_token"}
533 pc_test.SaveSession(startSession, reference)
535 pc_test.proxy.CookieRefresh = time.Hour
536 session, _, err := pc_test.LoadCookiedSession()
537 assert.NotEqual(t, nil, err)
538 if session != nil {
539 t.Errorf("expected nil session %#v", session)
540 }
543func NewAuthOnlyEndpointTest() *ProcessCookieTest {
544 pc_test := NewProcessCookieTestWithDefaults()
545 pc_test.req, _ = http.NewRequest("GET",
546 pc_test.opts.ProxyPrefix+"/auth", nil)
547 return pc_test
550func TestAuthOnlyEndpointAccepted(t *testing.T) {
551 test := NewAuthOnlyEndpointTest()
552 startSession := &providers.SessionState{
553 Email: "michael.bland@gsa.gov", AccessToken: "my_access_token"}
554 test.SaveSession(startSession, time.Now())
556 test.proxy.ServeHTTP(test.rw, test.req)
557 assert.Equal(t, http.StatusAccepted, test.rw.Code)
558 bodyBytes, _ := ioutil.ReadAll(test.rw.Body)
559 assert.Equal(t, "", string(bodyBytes))
562func TestAuthOnlyEndpointUnauthorizedOnNoCookieSetError(t *testing.T) {
563 test := NewAuthOnlyEndpointTest()
565 test.proxy.ServeHTTP(test.rw, test.req)
566 assert.Equal(t, http.StatusUnauthorized, test.rw.Code)
567 bodyBytes, _ := ioutil.ReadAll(test.rw.Body)
568 assert.Equal(t, "unauthorized request\n", string(bodyBytes))
571func TestAuthOnlyEndpointUnauthorizedOnExpiration(t *testing.T) {
572 test := NewAuthOnlyEndpointTest()
573 test.proxy.CookieExpire = time.Duration(24) * time.Hour
574 reference := time.Now().Add(time.Duration(25) * time.Hour * -1)
575 startSession := &providers.SessionState{
576 Email: "michael.bland@gsa.gov", AccessToken: "my_access_token"}
577 test.SaveSession(startSession, reference)
579 test.proxy.ServeHTTP(test.rw, test.req)
580 assert.Equal(t, http.StatusUnauthorized, test.rw.Code)
581 bodyBytes, _ := ioutil.ReadAll(test.rw.Body)
582 assert.Equal(t, "unauthorized request\n", string(bodyBytes))
585func TestAuthOnlyEndpointUnauthorizedOnEmailValidationFailure(t *testing.T) {
586 test := NewAuthOnlyEndpointTest()
587 startSession := &providers.SessionState{
588 Email: "michael.bland@gsa.gov", AccessToken: "my_access_token"}
589 test.SaveSession(startSession, time.Now())
590 test.validate_user = false
592 test.proxy.ServeHTTP(test.rw, test.req)
593 assert.Equal(t, http.StatusUnauthorized, test.rw.Code)
594 bodyBytes, _ := ioutil.ReadAll(test.rw.Body)
595 assert.Equal(t, "unauthorized request\n", string(bodyBytes))
598type SignatureAuthenticator struct {
599 auth hmacauth.HmacAuth
602func (v *SignatureAuthenticator) Authenticate(
603 w http.ResponseWriter, r *http.Request) {
604 result, headerSig, computedSig := v.auth.AuthenticateRequest(r)
605 if result == hmacauth.ResultNoSignature {
606 w.Write([]byte("no signature received"))
607 } else if result == hmacauth.ResultMatch {
608 w.Write([]byte("signatures match"))
609 } else if result == hmacauth.ResultMismatch {
610 w.Write([]byte("signatures do not match:" +
611 "\n received: " + headerSig +
612 "\n computed: " + computedSig))
613 } else {
614 panic("Unknown result value: " + result.String())
615 }
618type SignatureTest struct {
619 opts *Options
620 upstream *httptest.Server
621 upstream_host string
622 provider *httptest.Server
623 header http.Header
624 rw *httptest.ResponseRecorder
625 authenticator *SignatureAuthenticator
628func NewSignatureTest() *SignatureTest {
629 opts := NewOptions()
630 opts.CookieSecret = "cookie secret"
631 opts.ClientID = "client ID"
632 opts.ClientSecret = "client secret"
633 opts.EmailDomains = []string{"acm.org"}
635 authenticator := &SignatureAuthenticator{}
636 upstream := httptest.NewServer(
637 http.HandlerFunc(authenticator.Authenticate))
638 upstream_url, _ := url.Parse(upstream.URL)
639 opts.Upstreams = append(opts.Upstreams, upstream.URL)
641 providerHandler := func(w http.ResponseWriter, r *http.Request) {
642 w.Write([]byte(`{"access_token": "my_auth_token"}`))
643 }
644 provider := httptest.NewServer(http.HandlerFunc(providerHandler))
645 provider_url, _ := url.Parse(provider.URL)
646 opts.provider = NewTestProvider(provider_url, "mbland@acm.org")
648 return &SignatureTest{
649 opts,
650 upstream,
651 upstream_url.Host,
652 provider,
653 make(http.Header),
654 httptest.NewRecorder(),
655 authenticator,
656 }
659func (st *SignatureTest) Close() {
660 st.provider.Close()
661 st.upstream.Close()
664// fakeNetConn simulates an http.Request.Body buffer that will be consumed
665// when it is read by the hmacauth.HmacAuth if not handled properly. See:
666// https://github.com/18F/hmacauth/pull/4
667type fakeNetConn struct {
668 reqBody string
671func (fnc *fakeNetConn) Read(p []byte) (n int, err error) {
672 if bodyLen := len(fnc.reqBody); bodyLen != 0 {
673 copy(p, fnc.reqBody)
674 fnc.reqBody = ""
675 return bodyLen, io.EOF
676 }
677 return 0, io.EOF
680func (st *SignatureTest) MakeRequestWithExpectedKey(method, body, key string) {
681 err := st.opts.Validate()
682 if err != nil {
683 panic(err)
684 }
685 proxy := NewOAuthProxy(st.opts, func(email string) bool { return true })
687 var bodyBuf io.ReadCloser
688 if body != "" {
689 bodyBuf = ioutil.NopCloser(&fakeNetConn{reqBody: body})
690 }
691 req, err := http.NewRequest(method, "/foo/bar", bodyBuf)
692 if err != nil {
693 panic(err)
694 }
695 req.Header = st.header
697 state := &providers.SessionState{
698 Email: "mbland@acm.org", AccessToken: "my_access_token"}
699 value, err := proxy.provider.CookieForSession(state, proxy.CookieCipher)
700 if err != nil {
701 panic(err)
702 }
703 cookie := proxy.MakeCookie(req, value, proxy.CookieExpire, time.Now())
704 req.AddCookie(cookie)
705 // This is used by the upstream to validate the signature.
706 st.authenticator.auth = hmacauth.NewHmacAuth(
707 crypto.SHA1, []byte(key), SignatureHeader, SignatureHeaders)
708 proxy.ServeHTTP(st.rw, req)
711func TestNoRequestSignature(t *testing.T) {
712 st := NewSignatureTest()
713 defer st.Close()
714 st.MakeRequestWithExpectedKey("GET", "", "")
715 assert.Equal(t, 200, st.rw.Code)
716 assert.Equal(t, st.rw.Body.String(), "no signature received")
719func TestRequestSignatureGetRequest(t *testing.T) {
720 st := NewSignatureTest()
721 defer st.Close()
722 st.opts.SignatureKey = "sha1:foobar"
723 st.MakeRequestWithExpectedKey("GET", "", "foobar")
724 assert.Equal(t, 200, st.rw.Code)
725 assert.Equal(t, st.rw.Body.String(), "signatures match")
728func TestRequestSignaturePostRequest(t *testing.T) {
729 st := NewSignatureTest()
730 defer st.Close()
731 st.opts.SignatureKey = "sha1:foobar"
732 payload := `{ "hello": "world!" }`
733 st.MakeRequestWithExpectedKey("POST", payload, "foobar")
734 assert.Equal(t, 200, st.rw.Code)
735 assert.Equal(t, st.rw.Body.String(), "signatures match")