mirror of
https://github.com/pomerium/pomerium.git
synced 2025-05-01 03:16:31 +02:00
dc12947241
- all: prefer `FormValues` to `ParseForm` with subsequent `Form.Get`s - all: refactor authentication stack to be checked by middleware, and accessible via request context. - all: replace http.ServeMux with gorilla/mux’s router - all: replace custom CSRF checks with gorilla/csrf middleware - authenticate: extract callback path as constant. - internal/config: implement stringer interface for policy - internal/cryptutil: add helper func `NewBase64Key` - internal/cryptutil: rename `GenerateKey` to `NewKey` - internal/cryptutil: rename `GenerateRandomString` to `NewRandomStringN` - internal/middleware: removed alice in favor of gorilla/mux - internal/sessions: remove unused `ValidateRedirectURI` and `ValidateClientSecret` - internal/sessions: replace custom CSRF with gorilla/csrf fork that supports custom handler protection - internal/urlutil: add `SignedRedirectURL` to create hmac'd URLs - internal/urlutil: add `ValidateURL` helper to parse URL options - internal/urlutil: add `GetAbsoluteURL` which takes a request and returns its absolute URL. - proxy: remove holdover state verification checks; we no longer are setting sessions in any proxy routes so we don’t need them. - proxy: replace un-named http.ServeMux with named domain routes. Signed-off-by: Bobby DeSimone <bobbydesimone@gmail.com>
37 lines
898 B
Go
37 lines
898 B
Go
package httputil // import "github.com/pomerium/pomerium/internal/httputil"
|
|
|
|
import (
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"testing"
|
|
|
|
"github.com/google/go-cmp/cmp"
|
|
)
|
|
|
|
func TestCSRFFailureHandler(t *testing.T) {
|
|
|
|
tests := []struct {
|
|
name string
|
|
|
|
wantBody string
|
|
wantStatus int
|
|
}{
|
|
{"basic csrf failure", "{\"error\":\"CSRF Failure\"}\n", http.StatusForbidden},
|
|
}
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
r := httptest.NewRequest(http.MethodGet, "/", nil)
|
|
r.Header.Set("Accept", "application/json")
|
|
w := httptest.NewRecorder()
|
|
CSRFFailureHandler(w, r)
|
|
gotBody := w.Body.String()
|
|
gotStatus := w.Result().StatusCode
|
|
if diff := cmp.Diff(gotBody, tt.wantBody); diff != "" {
|
|
t.Errorf("RetrieveSession() = %s", diff)
|
|
}
|
|
if diff := cmp.Diff(gotStatus, tt.wantStatus); diff != "" {
|
|
t.Errorf("RetrieveSession() = %s", diff)
|
|
}
|
|
})
|
|
}
|
|
}
|