lukaszraczylo/traefikoidc
1
0
Fork 0
mirror of https://github.com/lukaszraczylo/traefikoidc.git synced 2026-10-15 04:18:03 +00:00
Code Issues Packages Projects Releases Wiki Activity

Modernize run

Browse Source
This commit is contained in:
lukaszraczylo
2025-06-20 08:02:26 +01:00
parent c400251625
commit c233aa92ef
26 changed files with 348 additions and 410 deletions
Download Patch File Download Diff File Expand all files Collapse all files
security_edge_cases_test.go
+22 -33
View File
@@ -11,6 +11,7 @@ import (
"fmt"
"net/http"
"net/http/httptest"
"slices"
"strings"
"testing"
"time"
@@ -25,7 +26,7 @@ func TestJWTAlgorithmConfusionAttack(t *testing.T) {
ts.Setup()
// Create a standard JWT with RS256 algorithm
validRS256JWT, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]interface{}{
validRS256JWT, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]any{
"iss": "https://test-issuer.com",
"aud": "test-client-id",
"exp": float64(time.Now().Add(1 * time.Hour).Unix()),
@@ -51,7 +52,7 @@ func TestJWTAlgorithmConfusionAttack(t *testing.T) {
}
// Parse header
var header map[string]interface{}
var header map[string]any
if err := json.Unmarshal(headerBytes, &header); err != nil {
t.Fatalf("Failed to unmarshal header: %v", err)
}
@@ -90,7 +91,7 @@ func TestJWTNoneAlgorithmAttack(t *testing.T) {
ts.Setup()
// Create a standard JWT
validJWT, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]interface{}{
validJWT, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]any{
"iss": "https://test-issuer.com",
"aud": "test-client-id",
"exp": float64(time.Now().Add(1 * time.Hour).Unix()),
@@ -116,7 +117,7 @@ func TestJWTNoneAlgorithmAttack(t *testing.T) {
}
// Parse header
var header map[string]interface{}
var header map[string]any
if err := json.Unmarshal(headerBytes, &header); err != nil {
t.Fatalf("Failed to unmarshal header: %v", err)
}
@@ -154,7 +155,7 @@ func TestJWTTokenTampering(t *testing.T) {
ts.Setup()
// Create a standard JWT
validJWT, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]interface{}{
validJWT, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]any{
"iss": "https://test-issuer.com",
"aud": "test-client-id",
"exp": float64(time.Now().Add(1 * time.Hour).Unix()),
@@ -180,7 +181,7 @@ func TestJWTTokenTampering(t *testing.T) {
}
// Parse claims
var claims map[string]interface{}
var claims map[string]any
if err := json.Unmarshal(claimsBytes, &claims); err != nil {
t.Fatalf("Failed to unmarshal claims: %v", err)
}
@@ -219,7 +220,7 @@ func TestJWTExpiredToken(t *testing.T) {
ts.Setup()
// Create a JWT that is already expired
expiredJWT, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]interface{}{
expiredJWT, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]any{
"iss": "https://test-issuer.com",
"aud": "test-client-id",
"exp": float64(time.Now().Add(-1 * time.Hour).Unix()), // Expired 1 hour ago
@@ -252,7 +253,7 @@ func TestJWTFutureToken(t *testing.T) {
ts.Setup()
// Create a JWT with a future issuance time
futureJWT, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]interface{}{
futureJWT, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]any{
"iss": "https://test-issuer.com",
"aud": "test-client-id",
"exp": float64(time.Now().Add(2 * time.Hour).Unix()),
@@ -315,7 +316,7 @@ func TestJWTReplayAttack(t *testing.T) {
fixedJTI := "fixed-test-jti-for-replay-" + generateRandomString(8)
// Create a JWT with the fixed JTI
replayJWT, err := createTestJWT(rsaPrivateKey, "RS256", "test-key-id", map[string]interface{}{
replayJWT, err := createTestJWT(rsaPrivateKey, "RS256", "test-key-id", map[string]any{
"iss": "https://test-issuer.com",
"aud": "test-client-id",
"exp": float64(time.Now().Add(1 * time.Hour).Unix()),
@@ -422,7 +423,7 @@ func TestMissingClaims(t *testing.T) {
for _, tc := range testCases {
t.Run(tc.name, func(t *testing.T) {
// Create standard claims
claims := map[string]interface{}{
claims := map[string]any{
"iss": "https://test-issuer.com",
"aud": "test-client-id",
"exp": float64(time.Now().Add(1 * time.Hour).Unix()),
@@ -598,13 +599,7 @@ func TestSessionFixationAttack(t *testing.T) {
// - The response is unauthorized (401), OR
// - The token verification failed
expectedCodes := []int{http.StatusFound, http.StatusUnauthorized, http.StatusForbidden}
codeFound := false
for _, code := range expectedCodes {
if victimResp.Code == code {
codeFound = true
break
}
}
codeFound := slices.Contains(expectedCodes, victimResp.Code)
if !codeFound {
t.Errorf("Expected status code to be one of %v, but got %d", expectedCodes, victimResp.Code)
@@ -829,7 +824,7 @@ func TestTokenBlacklisting(t *testing.T) {
}
// Create a valid JWT
validJWT, err := createTestJWT(rsaPrivateKey, "RS256", "test-key-id", map[string]interface{}{
validJWT, err := createTestJWT(rsaPrivateKey, "RS256", "test-key-id", map[string]any{
"iss": "https://test-issuer.com",
"aud": "test-client-id",
"exp": float64(time.Now().Add(1 * time.Hour).Unix()),
@@ -919,7 +914,7 @@ func TestDifferentSigningAlgorithms(t *testing.T) {
for _, tc := range testCases {
t.Run(tc.name, func(t *testing.T) {
// Define standard claims with unique JTI for each test
standardClaims := map[string]interface{}{
standardClaims := map[string]any{
"iss": "https://test-issuer.com",
"aud": "test-client-id",
"exp": float64(time.Now().Add(1 * time.Hour).Unix()),
@@ -1022,9 +1017,9 @@ func TestDifferentSigningAlgorithms(t *testing.T) {
}
// createTestJWTWithECKey creates a JWT signed with an EC private key
func createTestJWTWithECKey(privateKey *ecdsa.PrivateKey, alg, kid string, claims map[string]interface{}) (string, error) {
func createTestJWTWithECKey(privateKey *ecdsa.PrivateKey, alg, kid string, claims map[string]any) (string, error) {
// Create the header
header := map[string]interface{}{
header := map[string]any{
"alg": alg,
"typ": "JWT",
"kid": kid,
@@ -1281,7 +1276,7 @@ func TestRateLimiting(t *testing.T) {
tOidc.tokenVerifier = tOidc
// Create a valid JWT token
validJWT, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]interface{}{
validJWT, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]any{
"iss": "https://test-issuer.com",
"aud": "test-client-id",
"exp": float64(time.Now().Add(1 * time.Hour).Unix()),
@@ -1301,7 +1296,7 @@ func TestRateLimiting(t *testing.T) {
}
// Second request should succeed
validJWT2, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]interface{}{
validJWT2, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]any{
"iss": "https://test-issuer.com",
"aud": "test-client-id",
"exp": float64(time.Now().Add(1 * time.Hour).Unix()),
@@ -1320,7 +1315,7 @@ func TestRateLimiting(t *testing.T) {
}
// Third request should be rate limited
validJWT3, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]interface{}{
validJWT3, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]any{
"iss": "https://test-issuer.com",
"aud": "test-client-id",
"exp": float64(time.Now().Add(1 * time.Hour).Unix()),
@@ -1404,13 +1399,7 @@ func TestAuthorizationHeaderBypass(t *testing.T) {
// Verify that the response is a redirect to authentication (302) or unauthorized (401)
expectedCodes := []int{http.StatusFound, http.StatusUnauthorized}
codeFound := false
for _, code := range expectedCodes {
if resp.Code == code {
codeFound = true
break
}
}
codeFound := slices.Contains(expectedCodes, resp.Code)
if !codeFound {
t.Errorf("Expected status code to be one of %v, but got %d", expectedCodes, resp.Code)
@@ -1423,7 +1412,7 @@ func TestEmptyAudience(t *testing.T) {
ts.Setup()
// Create a JWT with empty audience
emptyAudJWT, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]interface{}{
emptyAudJWT, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]any{
"iss": "https://test-issuer.com",
"aud": "", // Empty audience
"exp": float64(time.Now().Add(1 * time.Hour).Unix()),
@@ -1456,7 +1445,7 @@ func TestEmptyIssuer(t *testing.T) {
ts.Setup()
// Create a JWT with empty issuer
emptyIssJWT, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]interface{}{
emptyIssJWT, err := createTestJWT(ts.rsaPrivateKey, "RS256", "test-key-id", map[string]any{
"iss": "", // Empty issuer
"aud": "test-client-id",
"exp": float64(time.Now().Add(1 * time.Hour).Unix()),