mirror of
https://github.com/lukaszraczylo/traefikoidc.git
synced 2026-11-03 07:44:13 +00:00
lukaszraczylo
2cb42aa485
With backchannel or frontchannel logout on, every authenticated request parsed the ID token twice to read sid, sub and iat. One shared parse now returns the same values. A test pins equality with the two separate calls for valid, partial and malformed tokens. The gain is one parseJWT call fewer per request. I did not measure it under yaegi.
35 lines
1.4 KiB
Go
35 lines
1.4 KiB
Go
package traefikoidc
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"github.com/gorilla/sessions"
|
|
)
|
|
|
|
// invalidationInputs must return exactly what extractSessionInfo and
|
|
// sessionCreatedAtForInvalidation return when called separately.
|
|
func TestInvalidationInputsMatchSeparateCalls(t *testing.T) {
|
|
oidc := &TraefikOidc{logger: newNoOpLogger()}
|
|
sess := &SessionData{mainSession: &sessions.Session{Values: map[interface{}]interface{}{"created_at": int64(1700000000)}}}
|
|
|
|
tokens := map[string]string{
|
|
"all claims": makeTestJWT(t, map[string]interface{}{"sid": "s1", "sub": "u1", "iat": float64(1700000100)}),
|
|
"no iat": makeTestJWT(t, map[string]interface{}{"sid": "s1", "sub": "u1"}),
|
|
"sid only": makeTestJWT(t, map[string]interface{}{"sid": "s1", "iat": float64(1700000200)}),
|
|
"sub only": makeTestJWT(t, map[string]interface{}{"sub": "u1"}),
|
|
"wrong types": makeTestJWT(t, map[string]interface{}{"sid": 5, "sub": true, "iat": "x"}),
|
|
"malformed": "not-a-jwt",
|
|
"empty": "",
|
|
}
|
|
for name, tok := range tokens {
|
|
t.Run(name, func(t *testing.T) {
|
|
wantSID, wantSub, _ := oidc.extractSessionInfo(tok)
|
|
wantAt := oidc.sessionCreatedAtForInvalidation(tok, sess)
|
|
gotSID, gotSub, gotAt := oidc.invalidationInputs(tok, sess)
|
|
if gotSID != wantSID || gotSub != wantSub || !gotAt.Equal(wantAt) {
|
|
t.Fatalf("got (%q,%q,%v) want (%q,%q,%v)", gotSID, gotSub, gotAt, wantSID, wantSub, wantAt)
|
|
}
|
|
})
|
|
}
|
|
}
|