1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
|
//go:build !go1.11
// +build !go1.11
// file for compatibility with go versions prior to 1.11
package csrf
import (
"errors"
"fmt"
"net/http"
"net/http/httptest"
"strings"
"testing"
"github.com/gorilla/securecookie"
)
// Check store implementations
var _ store = &cookieStore{}
// brokenSaveStore is a CSRF store that cannot, well, save.
type brokenSaveStore struct {
store
}
func (bs *brokenSaveStore) Get(*http.Request) ([]byte, error) {
// Generate an invalid token so we can progress to our Save method
return generateRandomBytes(24)
}
func (bs *brokenSaveStore) Save(realToken []byte, w http.ResponseWriter) error {
return errors.New("test error")
}
// Tests for failure if the middleware can't save to the Store.
func TestStoreCannotSave(t *testing.T) {
s := http.NewServeMux()
bs := &brokenSaveStore{}
s.HandleFunc("/", testHandler)
p := Protect(testKey, setStore(bs))(s)
r, err := http.NewRequest("GET", "/", nil)
if err != nil {
t.Fatal(err)
}
rr := httptest.NewRecorder()
p.ServeHTTP(rr, r)
if rr.Code != http.StatusForbidden {
t.Fatalf("broken store did not set an error status: got %v want %v",
rr.Code, http.StatusForbidden)
}
if c := rr.Header().Get("Set-Cookie"); c != "" {
t.Fatalf("broken store incorrectly set a cookie: got %v want %v",
c, "")
}
}
// TestCookieDecode tests that an invalid cookie store returns a decoding error.
func TestCookieDecode(t *testing.T) {
r, err := http.NewRequest("GET", "/", nil)
if err != nil {
t.Fatal(err)
}
var age = 3600
// Test with a nil hash key
sc := securecookie.New(nil, nil)
sc.MaxAge(age)
st := &cookieStore{cookieName, age, true, true, "", "", sc, SameSiteDefaultMode}
// Set a fake cookie value so r.Cookie passes.
r.Header.Set("Cookie", fmt.Sprintf("%s=%s", cookieName, "notacookie"))
_, err = st.Get(r)
if err == nil {
t.Fatal("cookiestore did not report an invalid hashkey on decode")
}
}
// TestCookieEncode tests that an invalid cookie store returns an encoding error.
func TestCookieEncode(t *testing.T) {
var age = 3600
// Test with a nil hash key
sc := securecookie.New(nil, nil)
sc.MaxAge(age)
st := &cookieStore{cookieName, age, true, true, "", "", sc, SameSiteDefaultMode}
rr := httptest.NewRecorder()
err := st.Save(nil, rr)
if err == nil {
t.Fatal("cookiestore did not report an invalid hashkey on encode")
}
}
// TestMaxAgeZero tests that setting MaxAge(0) does not set the Expires
// attribute on the cookie.
func TestMaxAgeZero(t *testing.T) {
var age = 0
s := http.NewServeMux()
s.HandleFunc("/", testHandler)
r, err := http.NewRequest("GET", "/", nil)
if err != nil {
t.Fatal(err)
}
rr := httptest.NewRecorder()
p := Protect(testKey, MaxAge(age))(s)
p.ServeHTTP(rr, r)
if rr.Code != http.StatusOK {
t.Fatalf("middleware failed to pass to the next handler: got %v want %v",
rr.Code, http.StatusOK)
}
if rr.Header().Get("Set-Cookie") == "" {
t.Fatalf("cookie not set: got %q", rr.Header().Get("Set-Cookie"))
}
cookie := rr.Header().Get("Set-Cookie")
if !strings.Contains(cookie, "HttpOnly") || strings.Contains(cookie, "Expires") {
t.Fatalf("cookie incorrectly has the Expires attribute set: got %q", cookie)
}
}
// TestSameSizeSet tests that setting SameSite Option does not set the SameSite
// attribute on the cookie in legacy systems.
func TestSameSizeSet(t *testing.T) {
s := http.NewServeMux()
s.HandleFunc("/", testHandler)
r, err := http.NewRequest("GET", "/", nil)
if err != nil {
t.Fatal(err)
}
rr := httptest.NewRecorder()
p := Protect(testKey, SameSite(SameSiteStrictMode))(s)
p.ServeHTTP(rr, r)
if rr.Code != http.StatusOK {
t.Fatalf("middleware failed to pass to the next handler: got %v want %v",
rr.Code, http.StatusOK)
}
if rr.Header().Get("Set-Cookie") == "" {
t.Fatalf("cookie not set: got %q", rr.Header().Get("Set-Cookie"))
}
cookie := rr.Header().Get("Set-Cookie")
if strings.Contains(cookie, "SameSite") {
t.Fatalf("cookie incorrectly has the SameSite attribute set: got %q", cookie)
}
}
|
