Uwe Schuster
fafee1278f
M-1 TokenExtract: exact-name cookie parse (new pure cookieValue helper) —
a substring find("session=") could be shadowed by a sibling xsession=,
defeating __Host-/__Secure- prefix guarantees.
M-2 AuthInterceptor: gate setup-mode pseudo-admin on a loopback bind and log
the grant; document that IAuthBackend::hasActiveUsers() must fail closed.
M-3 ws/Hub: empty propertyIds now means NO access for non-admins (was "all") —
a non-admin whose scope set failed to populate no longer gets every
property's notifications. Admins still get all via role.
M-4 new util/OriginCheck.hpp (originHostname/sameOrigin/originAllowed) +
Hub doc: WSController must validate Origin at the handshake (CSWSH).
M-6 RedactedFieldRepository: ctor throws on an unknown redaction field name
(a typo would silently redact nothing, leaving credentials in history).
M-7 RateLimiter: ctor validates capacity (finite >=1) / refillRate (finite >0),
throws std::invalid_argument — zero/negative/NaN silently disabled it.
M-8 TokenExtract: document that clientIpTrusted's "unknown"/"invalid" sentinels
collapse to one shared rate-limit bucket off-proxy.
M-9 new util/SessionCookie.hpp: safe-by-default Set-Cookie builder
(HttpOnly+Secure+SameSite=Strict+Path=/), rejects control chars / ';'.
M-10 AuthInterceptor: Origin/Referer-vs-Host check on session mutations
(defence in depth atop X-Requested-With); cert path documented as
non-browser / not CSRF-gated.
M-11 AuthInterceptor: optional injected RateLimiter throttles invalid-token
attempts per client IP → 429.
M-12 AuthInterceptor: sanitize request method/path (strip control chars, cap
length) before logging — closes log-line forging (CWE-117).
(M-5 — temporal non-atomic save — was already resolved by the H-4 fix.)
Tests: new test_token_extract / test_rate_limiter / test_origin_check /
test_session_cookie; extended test_redacted_field_repository. All 19 ctest
targets pass. README + header docs updated.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
59 lines
2.3 KiB
C++
59 lines
2.3 KiB
C++
// Tests for oatpp-authkit/util/OriginCheck.hpp (authkit#16 M-4 / M-10).
|
|
|
|
#include "oatpp-authkit/util/OriginCheck.hpp"
|
|
|
|
#include <cstdio>
|
|
#include <string>
|
|
#include <vector>
|
|
|
|
namespace {
|
|
|
|
int g_failures = 0;
|
|
#define REQUIRE(expr) do { \
|
|
if (!(expr)) { \
|
|
std::fprintf(stderr, "FAIL %s:%d %s\n", __FILE__, __LINE__, #expr); \
|
|
++g_failures; \
|
|
} \
|
|
} while (0)
|
|
|
|
using namespace oatpp_authkit;
|
|
|
|
void test_origin_hostname() {
|
|
REQUIRE(originHostname("https://app.example.com") == "app.example.com");
|
|
REQUIRE(originHostname("https://app.example.com:8443/x?y=1") == "app.example.com");
|
|
REQUIRE(originHostname("app.example.com:443") == "app.example.com");
|
|
REQUIRE(originHostname("HTTP://App.Example.COM") == "app.example.com");
|
|
REQUIRE(originHostname("example.com") == "example.com");
|
|
}
|
|
|
|
void test_same_origin() {
|
|
// Origin host matches Host (port/scheme ignored).
|
|
REQUIRE(sameOrigin("https://example.com", "example.com"));
|
|
REQUIRE(sameOrigin("https://example.com:8443", "example.com"));
|
|
REQUIRE(sameOrigin("https://example.com/page", "example.com")); // Referer form
|
|
REQUIRE(sameOrigin("https://example.com", "example.com:443"));
|
|
// Cross-host → blocked.
|
|
REQUIRE(!sameOrigin("https://evil.com", "example.com"));
|
|
REQUIRE(!sameOrigin("https://example.com.evil.com", "example.com"));
|
|
// Empty inputs → can't decide → don't block (caller falls back).
|
|
REQUIRE(sameOrigin("", "example.com"));
|
|
REQUIRE(sameOrigin("https://example.com", ""));
|
|
}
|
|
|
|
void test_origin_allowed() {
|
|
std::vector<std::string> allow = {"app.example.com", "https://admin.example.com"};
|
|
REQUIRE(originAllowed("https://app.example.com", allow));
|
|
REQUIRE(originAllowed("https://admin.example.com:8443/x", allow));
|
|
REQUIRE(!originAllowed("https://evil.com", allow));
|
|
REQUIRE(!originAllowed("", allow)); // fail closed
|
|
}
|
|
|
|
} // namespace
|
|
|
|
int main() {
|
|
test_origin_hostname();
|
|
test_same_origin();
|
|
test_origin_allowed();
|
|
std::printf("%s (%d failures)\n", g_failures ? "FAIL" : "OK", g_failures);
|
|
return g_failures ? 1 : 0;
|
|
}
|