@@ -92,6 +92,7 @@ Nnc3a3lGVWFCNUMxQnNJcnJMTWxka1dFaHluYmI4Ongtb2F1dGgtYmFzaWM=`
9292 authorizationHeader string
9393 existingSession *sessionsapi.SessionState
9494 expectedSession *sessionsapi.SessionState
95+ expectedStatus int
9596 }
9697
9798 DescribeTable("with an authorization header",
@@ -114,12 +115,13 @@ Nnc3a3lGVWFCNUMxQnNJcnJMTWxka1dFaHluYmI4Ongtb2F1dGgtYmFzaWM=`
114115 // Create the handler with a next handler that will capture the session
115116 // from the scope
116117 var gotSession *sessionsapi.SessionState
117− handler := NewJwtSessionLoader(sessionLoaders)(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
118+ handler := NewJwtSessionLoader(sessionLoaders, true)(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
118119 gotSession = middlewareapi.GetRequestScope(r).Session
119120 }))
120121 handler.ServeHTTP(rw, req)
121122
122123 Expect(gotSession).To(Equal(in.expectedSession))
124+ Expect(rw.Code).To(Equal(200))
123125 },
124126 Entry("<no value>", jwtSessionLoaderTableInput{
125127 authorizationHeader: "",
@@ -163,6 +165,83 @@ Nnc3a3lGVWFCNUMxQnNJcnJMTWxka1dFaHluYmI4Ongtb2F1dGgtYmFzaWM=`
163165 }),
164166 )
165167
168+ DescribeTable("with an authorization header, denyInvalidJWTs",
169+ func(in jwtSessionLoaderTableInput) {
170+ scope := &middlewareapi.RequestScope{
171+ Session: in.existingSession,
172+ }
173+
174+ // Set up the request with the authorization header and a request scope
175+ req := httptest.NewRequest("", "/", nil)
176+ req.Header.Set("Authorization", in.authorizationHeader)
177+ req = middlewareapi.AddRequestScope(req, scope)
178+
179+ rw := httptest.NewRecorder()
180+
181+ sessionLoaders := []middlewareapi.TokenToSessionFunc{
182+ middlewareapi.CreateTokenToSessionFunc(verifier),
183+ }
184+
185+ // Create the handler with a next handler that will capture the session
186+ // from the scope
187+ var gotSession *sessionsapi.SessionState
188+ handler := NewJwtSessionLoader(sessionLoaders, false)(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
189+ gotSession = middlewareapi.GetRequestScope(r).Session
190+ }))
191+ handler.ServeHTTP(rw, req)
192+
193+ Expect(gotSession).To(Equal(in.expectedSession))
194+ Expect(rw.Code).To(Equal(in.expectedStatus))
195+ },
196+ Entry("<no value>", jwtSessionLoaderTableInput{
197+ authorizationHeader: "",
198+ existingSession: nil,
199+ expectedSession: nil,
200+ expectedStatus: 200,
201+ }),
202+ Entry("abcdef", jwtSessionLoaderTableInput{
203+ authorizationHeader: "abcdef",
204+ existingSession: nil,
205+ expectedSession: nil,
206+ expectedStatus: 403,
207+ }),
208+ Entry("abcdef (with existing session)", jwtSessionLoaderTableInput{
209+ authorizationHeader: "abcdef",
210+ existingSession: &sessionsapi.SessionState{User: "user"},
211+ expectedSession: &sessionsapi.SessionState{User: "user"},
212+ expectedStatus: 200,
213+ }),
214+ Entry("Bearer <verifiedToken>", jwtSessionLoaderTableInput{
215+ authorizationHeader: fmt.Sprintf("Bearer %s", verifiedToken),
216+ existingSession: nil,
217+ expectedSession: verifiedSession,
218+ expectedStatus: 200,
219+ }),
220+ Entry("Bearer <nonVerifiedToken>", jwtSessionLoaderTableInput{
221+ authorizationHeader: fmt.Sprintf("Bearer %s", nonVerifiedToken),
222+ existingSession: nil,
223+ expectedSession: nil,
224+ expectedStatus: 403,
225+ }),
226+ Entry("Bearer <verifiedToken> (with existing session)", jwtSessionLoaderTableInput{
227+ authorizationHeader: fmt.Sprintf("Bearer %s", verifiedToken),
228+ existingSession: &sessionsapi.SessionState{User: "user"},
229+ expectedSession: &sessionsapi.SessionState{User: "user"},
230+ expectedStatus: 200,
231+ }),
232+ Entry("Basic Base64(<nonVerifiedToken>:) (No password)", jwtSessionLoaderTableInput{
233+ authorizationHeader: "Basic ZXlKZm9vYmFyLmV5SmZvb2Jhci4xMjM0NWFzZGY6",
234+ existingSession: nil,
235+ expectedSession: nil,
236+ expectedStatus: 403,
237+ }),
238+ Entry("Basic Base64(<verifiedToken>:x-oauth-basic) (Sentinel password)", jwtSessionLoaderTableInput{
239+ authorizationHeader: fmt.Sprintf("Basic %s", verifiedTokenXOAuthBasicBase64),
240+ existingSession: nil,
241+ expectedSession: verifiedSession,
242+ expectedStatus: 200,
243+ }),
244+ )
166245 })
167246
168247 Context("getJWTSession", func() {