52 lines
1.9 KiB
Ruby
52 lines
1.9 KiB
Ruby
require 'minitest/autorun'
|
|
require 'prism'
|
|
|
|
class SessionTest < Minitest::Test
|
|
def test_roundtrip
|
|
cookie = Prism::Session.encode({ 'user' => 'foksiu', 'count' => 3 }, 'top-secret')
|
|
decoded = Prism::Session.decode(cookie, 'top-secret')
|
|
assert_equal 'foksiu', decoded['user']
|
|
assert_equal 3, decoded['count']
|
|
end
|
|
|
|
def test_tampering_rejected
|
|
cookie = Prism::Session.encode({ 'admin' => false }, 'top-secret')
|
|
payload, signature = cookie.split('--', 2)
|
|
forged = "#{payload}--#{'0' * signature.size}"
|
|
assert_equal({}, Prism::Session.decode(forged, 'top-secret'))
|
|
end
|
|
|
|
def test_wrong_secret
|
|
cookie = Prism::Session.encode({ 'x' => 1 }, 'secret-a')
|
|
assert_equal({}, Prism::Session.decode(cookie, 'secret-b'))
|
|
end
|
|
|
|
def test_cookie_is_url_safe
|
|
cookie = Prism::Session.encode({ 'blob' => 'a' * 60 }, 's')
|
|
assert_nil cookie[/[^A-Za-z0-9_\-]/], "expected url safe cookie, got: #{cookie}"
|
|
end
|
|
|
|
def test_missing_cookie
|
|
assert_equal({}, Prism::Session.decode(nil, 's'))
|
|
assert_equal({}, Prism::Session.decode('', 's'))
|
|
end
|
|
|
|
def test_previous_secrets_still_decode_a_cookie_signed_under_a_retired_secret
|
|
cookie = Prism::Session.encode({ 'user' => 'foksiu' }, 'old-secret')
|
|
decoded = Prism::Session.decode(cookie, 'new-secret', previous_secrets: ['old-secret'])
|
|
assert_equal 'foksiu', decoded['user']
|
|
end
|
|
|
|
def test_previous_secrets_do_not_accept_a_cookie_signed_under_neither_secret
|
|
cookie = Prism::Session.encode({ 'user' => 'foksiu' }, 'unrelated-secret')
|
|
decoded = Prism::Session.decode(cookie, 'new-secret', previous_secrets: ['old-secret'])
|
|
assert_equal({}, decoded)
|
|
end
|
|
|
|
def test_encode_always_signs_under_the_current_secret_not_a_previous_one
|
|
cookie = Prism::Session.encode({ 'user' => 'foksiu' }, 'new-secret')
|
|
assert_equal({}, Prism::Session.decode(cookie, 'old-secret'))
|
|
assert_equal 'foksiu', Prism::Session.decode(cookie, 'new-secret')['user']
|
|
end
|
|
end
|