41b21dd · typeable/oauth2-proxy

git.iko.soy/typeable/oauth2-proxy

Enforce that cookie_refresh < cookie_expire

commit41b21dd0b14ce867dc5130b5aadc6b964fda2409 authorMike Bland <michael.bland@gsa.gov> dateSat 9 May 2015, 17:16 (11 years ago) parent8ec967a

2 files changed+21

unifiedsplit

options.go+8

@@ -137,6 +137,14 @@ func (o *Options) Validate() error {

137137 }

138138 }

139139

140+ if o.CookieRefresh >= o.CookieExpire {

141+ msgs = append(msgs, fmt.Sprintf(

142+ "cookie_refresh (%s) must be less than "+

143+ "cookie_expire (%s)",

144+ o.CookieRefresh.String(),

145+ o.CookieExpire.String()))

146+ }

147+

140148 if len(msgs) != 0 {

141149 return fmt.Errorf("Invalid configuration:\n %s",

142150 strings.Join(msgs, "\n "))

options_test.go+13

@@ -4,6 +4,7 @@ import (

44 "net/url"

55 "strings"

66 "testing"

7+ "time"

89 "github.com/bmizerany/assert"

910)

@@ -125,3 +126,15 @@ func TestPassAccessTokenRequiresSpecificCookieSecretLengths(t *testing.T) {

125126 o.CookieSecret = "32 byte secret for AES-256------"

126127 assert.Equal(t, nil, o.Validate())

127128}

129+

130+func TestCookieRefreshMustBeLessThanCookieExpire(t *testing.T) {

131+ o := testOptions()

132+ assert.Equal(t, nil, o.Validate())

133+

134+ o.CookieSecret = "0123456789abcdef"

135+ o.CookieRefresh = o.CookieExpire

136+ assert.NotEqual(t, nil, o.Validate())

137+

138+ o.CookieRefresh -= time.Duration(1)

139+ assert.Equal(t, nil, o.Validate())

140+}