Skip to content

Commit 16c12cf

Browse files
dougwilsondougwilson
committed
tests: add more tests around signed cookies
1 parent 0dc9683 commit 16c12cf

File tree

1 file changed

+132
-31
lines changed

1 file changed

+132
-31
lines changed

‎test/test.js

+132-31
Original file line numberDiff line numberDiff line change
@@ -89,64 +89,159 @@ describe('Cookie Session', function () {
8989

9090
describe('when options.signed = true', function () {
9191
describe('when options.keys are set', function () {
92-
it('should work', function (done) {
93-
var app = connect()
94-
app.use(session({
95-
keys: ['a', 'b']
96-
}))
97-
app.use(function (req, res, next) {
92+
before(function () {
93+
this.app = connect()
94+
this.app.use(session({ keys: ['a', 'b'] }))
95+
this.app.use('/get', function (req, res) {
96+
res.setHeader('Content-Type', 'application/json')
97+
res.end(JSON.stringify(req.session))
98+
})
99+
this.app.use('/set', function (req, res) {
98100
req.session.message = 'hi'
99101
res.end()
100102
})
103+
})
101104

102-
request(app)
103-
.get('/')
105+
it('should set cookie signature', function (done) {
106+
request(this.app)
107+
.get('/set')
108+
.expect(shouldHaveCookie('session'))
109+
.expect(shouldHaveCookie('session.sig'))
104110
.expect(200, '', done)
105111
})
112+
113+
it('should set cookie signature with first key', function (done) {
114+
request(this.app)
115+
.get('/set')
116+
.expect(shouldHaveCookieWithValue('session', 'eyJtZXNzYWdlIjoiaGkifQ=='))
117+
.expect(shouldHaveCookieWithValue('session.sig', 'vdp2-kj-91tgzbWcV1QzofT3hu0'))
118+
.expect(200, '', done)
119+
})
120+
121+
it('should accept session with signature', function (done) {
122+
request(this.app)
123+
.get('/get')
124+
.set('Cookie', 'session=eyJtZXNzYWdlIjoiaGkifQ==; session.sig=vdp2-kj-91tgzbWcV1QzofT3hu0')
125+
.expect(200, { message: 'hi' }, done)
126+
})
127+
128+
it('should accept session with secondary signature', function (done) {
129+
request(this.app)
130+
.get('/get')
131+
.set('Cookie', 'session=eyJtZXNzYWdlIjoiaGkifQ==; session.sig=SiRRAEncekXEzVdvey_7SkWaMM4')
132+
.expect(200, { message: 'hi' }, done)
133+
})
134+
135+
it('should reject session with invalid signature', function (done) {
136+
request(this.app)
137+
.get('/get')
138+
.set('Cookie', 'session=eyJtZXNzYWdlIjoiaGkifQ==; session.sig=foobar')
139+
.expect(200, {}, done)
140+
})
141+
142+
it('should reject session with no signature', function (done) {
143+
request(this.app)
144+
.get('/get')
145+
.set('Cookie', 'session=eyJtZXNzYWdlIjoiaGkifQ==')
146+
.expect(200, {}, done)
147+
})
106148
})
107149

108150
describe('when options.secret is set', function () {
109-
it('should work', function (done) {
110-
var app = connect()
111-
app.use(session({
112-
secret: 'a'
113-
}))
114-
app.use(function (req, res, next) {
151+
before(function () {
152+
this.app = connect()
153+
this.app.use(session({ secret: 'a' }))
154+
this.app.use('/get', function (req, res) {
155+
res.setHeader('Content-Type', 'application/json')
156+
res.end(JSON.stringify(req.session))
157+
})
158+
this.app.use('/set', function (req, res) {
115159
req.session.message = 'hi'
116160
res.end()
117161
})
162+
})
118163

119-
request(app)
120-
.get('/')
164+
it('should set cookie signature', function (done) {
165+
request(this.app)
166+
.get('/set')
167+
.expect(shouldHaveCookie('session'))
168+
.expect(shouldHaveCookie('session.sig'))
121169
.expect(200, '', done)
122170
})
171+
172+
it('should set cookie signature with only key', function (done) {
173+
request(this.app)
174+
.get('/set')
175+
.expect(shouldHaveCookieWithValue('session', 'eyJtZXNzYWdlIjoiaGkifQ=='))
176+
.expect(shouldHaveCookieWithValue('session.sig', 'vdp2-kj-91tgzbWcV1QzofT3hu0'))
177+
.expect(200, '', done)
178+
})
179+
180+
it('should accept session with signature', function (done) {
181+
request(this.app)
182+
.get('/get')
183+
.set('Cookie', 'session=eyJtZXNzYWdlIjoiaGkifQ==; session.sig=vdp2-kj-91tgzbWcV1QzofT3hu0')
184+
.expect(200, { message: 'hi' }, done)
185+
})
186+
187+
it('should reject session with invalid signature', function (done) {
188+
request(this.app)
189+
.get('/get')
190+
.set('Cookie', 'session=eyJtZXNzYWdlIjoiaGkifQ==; session.sig=foobar')
191+
.expect(200, {}, done)
192+
})
193+
194+
it('should reject session with no signature', function (done) {
195+
request(this.app)
196+
.get('/get')
197+
.set('Cookie', 'session=eyJtZXNzYWdlIjoiaGkifQ==')
198+
.expect(200, {}, done)
199+
})
123200
})
124201

125202
describe('when options.keys are not set', function () {
126203
it('should throw', function () {
127204
assert.throws(function () {
128205
session()
129-
})
206+
}, /\.keys required/)
130207
})
131208
})
132209
})
133210

134211
describe('when options.signed = false', function () {
135-
describe('when app.keys are not set', function () {
136-
it('should work', function (done) {
137-
var app = connect()
138-
app.use(session({
139-
signed: false
140-
}))
141-
app.use(function (req, res, next) {
142-
req.session.message = 'hi'
143-
res.end()
144-
})
145-
146-
request(app)
147-
.get('/')
148-
.expect(200, done)
212+
before(function () {
213+
this.app = connect()
214+
this.app.use(session({ signed: false }))
215+
this.app.use('/get', function (req, res) {
216+
res.setHeader('Content-Type', 'application/json')
217+
res.end(JSON.stringify(req.session))
149218
})
219+
this.app.use('/set', function (req, res) {
220+
req.session.message = 'hi'
221+
res.end()
222+
})
223+
})
224+
225+
it('should not set cookie signature', function (done) {
226+
request(this.app)
227+
.get('/set')
228+
.expect(shouldHaveCookie('session'))
229+
.expect(shouldNotHaveCookie('session.sig'))
230+
.expect(200, done)
231+
})
232+
233+
it('should accept session without signature', function (done) {
234+
request(this.app)
235+
.get('/get')
236+
.set('Cookie', 'session=eyJtZXNzYWdlIjoiaGkifQ==')
237+
.expect(200, { message: 'hi' }, done)
238+
})
239+
240+
it('should accept session with invalid signature', function (done) {
241+
request(this.app)
242+
.get('/get')
243+
.set('Cookie', 'session=eyJtZXNzYWdlIjoiaGkifQ==; session.sig=foobar')
244+
.expect(200, { message: 'hi' }, done)
150245
})
151246
})
152247

@@ -557,6 +652,12 @@ function shouldHaveCookieWithValue (name, value) {
557652
}
558653
}
559654

655+
function shouldNotHaveCookie (name) {
656+
return function (res) {
657+
assert.ok(!(name in cookies(res)), 'should not have cookie "' + name + '"')
658+
}
659+
}
660+
560661
function shouldNotSetCookies () {
561662
return function (res) {
562663
assert.strictEqual(res.headers['set-cookie'], undefined, 'should not set cookies')

0 commit comments

Comments
 (0)