mirror of
https://github.com/lukaszraczylo/traefikoidc.git
synced 2026-11-04 07:53:59 +00:00
lukaszraczylo
83da8e0bc2
Back-channel logout keys for sub, sid and jti had no issuer or client in them, in a cache shared by every instance. A logout for user u1 in one realm logged out u1 in another, and an equal jti in two realms looked like a replay. Keys now carry the instance prefix. An instance without a prefix keeps the old key.
19 lines
673 B
Go
19 lines
673 B
Go
package traefikoidc
|
|
|
|
import "testing"
|
|
|
|
func TestSessionInvalidationKeyScopedPerInstance(t *testing.T) {
|
|
a := &TraefikOidc{tokenCache: &TokenCache{}}
|
|
b := &TraefikOidc{tokenCache: &TokenCache{}}
|
|
a.tokenCache.SetNamespace("https://kc/realms/a|c|c")
|
|
b.tokenCache.SetNamespace("https://kc/realms/b|c|c")
|
|
for _, kind := range []string{"sub", "sid", "jti"} {
|
|
if a.buildSessionInvalidationKey(kind, "u1") == b.buildSessionInvalidationKey(kind, "u1") {
|
|
t.Errorf("%s key shared across issuers", kind)
|
|
}
|
|
}
|
|
if got := (&TraefikOidc{}).buildSessionInvalidationKey("sub", "u1"); got != "session_invalidation:sub:u1" {
|
|
t.Errorf("namespace-less key changed: %q", got)
|
|
}
|
|
}
|