mirror of
https://github.com/lukaszraczylo/traefikoidc.git
synced 2026-11-03 07:44:13 +00:00
lukaszraczylo
2f0ee00e51
The introspection cache used the raw token as key in a shared cache. Two instances with different providers or clients shared results. Keys now use the same instance prefix as the verified-token cache.
70 lines
2.2 KiB
Go
70 lines
2.2 KiB
Go
package traefikoidc
|
|
|
|
import (
|
|
"testing"
|
|
"time"
|
|
)
|
|
|
|
func newNSCache(t *testing.T) *UniversalCache {
|
|
t.Helper()
|
|
c := NewUniversalCache(UniversalCacheConfig{Type: CacheTypeToken, MaxSize: 100, DefaultTTL: time.Hour, CleanupInterval: time.Hour})
|
|
t.Cleanup(func() { _ = c.Close() })
|
|
return c
|
|
}
|
|
|
|
// A verdict stored by one middleware instance must not satisfy another
|
|
// instance that verifies against a different client or audience.
|
|
func TestTokenCacheIsolatedPerInstanceNamespace(t *testing.T) {
|
|
shared := newNSCache(t)
|
|
a := &TokenCache{cache: shared}
|
|
b := &TokenCache{cache: shared}
|
|
a.SetNamespace("https://idp|app-a|app-a")
|
|
b.SetNamespace("https://idp|app-b|app-b")
|
|
|
|
a.Set("tok", map[string]interface{}{"sub": "u"}, time.Minute)
|
|
if _, ok := b.Get("tok"); ok {
|
|
t.Fatal("instance B hit a verdict cached by instance A")
|
|
}
|
|
if _, ok := a.Get("tok"); !ok {
|
|
t.Fatal("instance A lost its own verdict")
|
|
}
|
|
a.Delete("tok")
|
|
if _, ok := a.Get("tok"); ok {
|
|
t.Fatal("Delete did not remove the namespaced entry")
|
|
}
|
|
}
|
|
|
|
func TestTokenCacheNamespaceFollowsDCR(t *testing.T) {
|
|
shared := newNSCache(t)
|
|
tc := &TokenCache{cache: shared}
|
|
tc.SetNamespace("p|old|old")
|
|
tc.Set("tok", map[string]interface{}{"sub": "u"}, time.Minute)
|
|
tc.SetNamespace("p|new|new")
|
|
if _, ok := tc.Get("tok"); ok {
|
|
t.Fatal("verdict cached under the old client survived a namespace change")
|
|
}
|
|
}
|
|
|
|
func TestTokenCacheEmptyNamespaceKeepsLegacyKey(t *testing.T) {
|
|
shared := newNSCache(t)
|
|
a := &TokenCache{cache: shared}
|
|
b := &TokenCache{cache: shared}
|
|
a.Set("tok", map[string]interface{}{"sub": "u"}, time.Minute)
|
|
if _, ok := b.Get("tok"); !ok {
|
|
t.Fatal("namespace-less caches must keep sharing the legacy key")
|
|
}
|
|
}
|
|
|
|
func TestIntrospectionKeyScopedPerInstance(t *testing.T) {
|
|
a := &TraefikOidc{tokenCache: &TokenCache{}}
|
|
b := &TraefikOidc{tokenCache: &TokenCache{}}
|
|
a.tokenCache.SetNamespace("p|app-a|app-a")
|
|
b.tokenCache.SetNamespace("p|app-b|app-b")
|
|
if a.introspectionKey("tok") == b.introspectionKey("tok") {
|
|
t.Fatal("different instances share an introspection cache key")
|
|
}
|
|
if got := (&TraefikOidc{}).introspectionKey("tok"); got != "tok" {
|
|
t.Fatalf("namespace-less key = %q, want raw token", got)
|
|
}
|
|
}
|