mirror of
https://github.com/lukaszraczylo/traefikoidc.git
synced 2026-10-12 04:04:26 +00:00
lukaszraczylo
6d96e8869b
- fail-on-old regression tests for every shipped fix (R-rounds) - fuzz targets (parseJWT, bearer), concurrency-stress, shuffle-flake guards - coverage-closing contract tests (health-check backend, TLS-posture reuse) - r154 ID-token fixture built from parts to avoid false-positive secret scan
23 lines
918 B
Go
23 lines
918 B
Go
package traefikoidc
|
|
|
|
import "testing"
|
|
|
|
// TestReplayCacheKey_NamespacedByIssuer verifies JTI replay entries are
|
|
// keyed by issuer (not a bare jti), so tokens issued by different OIDC
|
|
// providers sharing the process-global replay cache never collide (R142).
|
|
func TestReplayCacheKey_NamespacedByIssuer(t *testing.T) {
|
|
if replayCacheKey("https://issuer-a.example.com", "jti-1") == replayCacheKey("https://issuer-b.example.com", "jti-1") {
|
|
t.Fatal("same jti from different issuers must not share a replay key")
|
|
}
|
|
// Same issuer + jti is stable (idempotent) for the gate to work.
|
|
k1 := replayCacheKey("issuer", "jti")
|
|
k2 := replayCacheKey("issuer", "jti")
|
|
if k1 != k2 {
|
|
t.Fatal("same issuer+jti must be stable")
|
|
}
|
|
// Different jti under the same issuer must differ.
|
|
if replayCacheKey("issuer", "jti-1") == replayCacheKey("issuer", "jti-2") {
|
|
t.Fatal("different jti under the same issuer must differ")
|
|
}
|
|
}
|