mirror of
https://github.com/lukaszraczylo/traefikoidc.git
synced 2026-10-12 04:04:26 +00:00
lukaszraczylo
6d96e8869b
- fail-on-old regression tests for every shipped fix (R-rounds) - fuzz targets (parseJWT, bearer), concurrency-stress, shuffle-flake guards - coverage-closing contract tests (health-check backend, TLS-posture reuse) - r154 ID-token fixture built from parts to avoid false-positive secret scan
41 lines
1.6 KiB
Go
41 lines
1.6 KiB
Go
package traefikoidc
|
|
|
|
import "testing"
|
|
|
|
// TestValidateAzureTokensRS_OpaqueNoIDToken_FailsClosed regresses the Azure
|
|
// path accepting an opaque (non-JWT) access token with NO ID token as
|
|
// authenticated with zero verification (previously `return true,false,false`
|
|
// at validateAzureTokensRS's opaque branch). It must now fail closed and
|
|
// mirror validateStandardTokensRS: refresh if possible, else force
|
|
// re-authentication — regardless of allowOpaqueTokens (an ID token is
|
|
// needed to corroborate, and introspection only validates activity, not
|
|
// that this session owns the token).
|
|
func TestValidateAzureTokensRS_OpaqueNoIDToken_FailsClosed(t *testing.T) {
|
|
for _, allowOpaque := range []bool{false, true} {
|
|
oidc := &TraefikOidc{allowOpaqueTokens: allowOpaque}
|
|
|
|
// No refresh token available -> must force re-authentication.
|
|
rs := &requestState{
|
|
authenticated: true,
|
|
accessToken: "opaque-access-00000000", // no dots -> opaque
|
|
}
|
|
auth, refresh, expired := oidc.validateAzureTokensRS(rs)
|
|
if auth || refresh || !expired {
|
|
t.Fatalf("allowOpaque=%v, no refresh: want fail-closed (false,false,true), got (auth=%v,refresh=%v,reauth=%v)",
|
|
allowOpaque, auth, refresh, expired)
|
|
}
|
|
|
|
// Refresh token available -> must prefer refresh, still not auth.
|
|
rs2 := &requestState{
|
|
authenticated: true,
|
|
accessToken: "opaque-access-00000000",
|
|
refreshToken: "refresh-1111",
|
|
}
|
|
auth, refresh, expired = oidc.validateAzureTokensRS(rs2)
|
|
if auth || !refresh || expired {
|
|
t.Fatalf("allowOpaque=%v, with refresh: want (false,true,false) refresh path, got (auth=%v,refresh=%v,reauth=%v)",
|
|
allowOpaque, auth, refresh, expired)
|
|
}
|
|
}
|
|
}
|