-
Notifications
You must be signed in to change notification settings - Fork 2.1k
/
cookie_tossing_spec.rb
74 lines (63 loc) · 2.71 KB
/
cookie_tossing_spec.rb
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
describe Rack::Protection::CookieTossing do
it_behaves_like "any rack application"
context 'with default reaction' do
before(:each) do
mock_app do
use Rack::Protection::CookieTossing
run DummyApp
end
end
it 'accepts requests with a single session cookie' do
get '/', {}, 'HTTP_COOKIE' => 'rack.session=SESSION_TOKEN'
expect(last_response).to be_ok
end
it 'denies requests with duplicate session cookies' do
get '/', {}, 'HTTP_COOKIE' => 'rack.session=EVIL_SESSION_TOKEN; rack.session=SESSION_TOKEN'
expect(last_response).not_to be_ok
end
it 'denies requests with sneaky encoded session cookies' do
get '/', {}, 'HTTP_COOKIE' => 'rack.session=EVIL_SESSION_TOKEN; rack.%73ession=SESSION_TOKEN'
expect(last_response).not_to be_ok
end
it 'adds the correct Set-Cookie header' do
get '/some/path', {}, 'HTTP_COOKIE' => 'rack.%73ession=EVIL_SESSION_TOKEN; rack.session=EVIL_SESSION_TOKEN; rack.session=SESSION_TOKEN'
expected_header = <<-END.chomp
rack.%2573ession=; domain=example.org; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT
rack.%2573ession=; domain=example.org; path=/some; expires=Thu, 01 Jan 1970 00:00:00 GMT
rack.%2573ession=; domain=example.org; path=/some/path; expires=Thu, 01 Jan 1970 00:00:00 GMT
rack.session=; domain=example.org; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT
rack.session=; domain=example.org; path=/some; expires=Thu, 01 Jan 1970 00:00:00 GMT
rack.session=; domain=example.org; path=/some/path; expires=Thu, 01 Jan 1970 00:00:00 GMT
END
expect(last_response.headers['Set-Cookie']).to eq(expected_header)
end
end
context 'with redirect reaction' do
before(:each) do
mock_app do
use Rack::Protection::CookieTossing, :reaction => :redirect
run DummyApp
end
end
it 'redirects requests with duplicate session cookies' do
get '/', {}, 'HTTP_COOKIE' => 'rack.session=EVIL_SESSION_TOKEN; rack.session=SESSION_TOKEN'
expect(last_response).to be_redirect
expect(last_response.location).to eq('/')
end
it 'redirects requests with sneaky encoded session cookies' do
get '/path', {}, 'HTTP_COOKIE' => 'rack.%73ession=EVIL_SESSION_TOKEN; rack.session=SESSION_TOKEN'
expect(last_response).to be_redirect
expect(last_response.location).to eq('/path')
end
end
context 'with custom session key' do
it 'denies requests with duplicate session cookies' do
mock_app do
use Rack::Protection::CookieTossing, :session_key => '_session'
run DummyApp
end
get '/', {}, 'HTTP_COOKIE' => '_session=EVIL_SESSION_TOKEN; _session=SESSION_TOKEN'
expect(last_response).not_to be_ok
end
end
end