mirror of
https://github.com/0rangebananaspy/authelia.git
synced 2024-09-14 22:47:21 +07:00
6b78240d39
From this commit on, api endpoints reply with a 401 error code and non api endpoints redirect to /error/40X. This commit also fixes missing restrictions on /loggedin (the "already logged in page). This was not a security issue, though. The change also makes error pages automatically redirect the user after few seconds based on the referrer or the default_redirection_url if provided in the configuration. Warning: The old /verify endpoint of the REST API has moved to /api/verify. You will need to update your nginx configuration to take this change into account.
76 lines
2.3 KiB
TypeScript
76 lines
2.3 KiB
TypeScript
|
|
import sinon = require("sinon");
|
|
import BluebirdPromise = require("bluebird");
|
|
import assert = require("assert");
|
|
import U2FSignRequestGet = require("../../../../../src/lib/routes/secondfactor/u2f/sign_request/get");
|
|
import ExpressMock = require("../../../../mocks/express");
|
|
import { UserDataStoreStub } from "../../../../mocks/storage/UserDataStoreStub";
|
|
import U2FMock = require("../../../../mocks/u2f");
|
|
import U2f = require("u2f");
|
|
import { ServerVariablesMock, ServerVariablesMockBuilder } from "../../../../mocks/ServerVariablesMockBuilder";
|
|
import { ServerVariables } from "../../../../../src/lib/ServerVariables";
|
|
|
|
import { SignMessage } from "../../../../../../shared/SignMessage";
|
|
|
|
describe("test u2f routes: sign_request", function () {
|
|
let req: ExpressMock.RequestMock;
|
|
let res: ExpressMock.ResponseMock;
|
|
let mocks: ServerVariablesMock;
|
|
let vars: ServerVariables;
|
|
|
|
beforeEach(function () {
|
|
req = ExpressMock.RequestMock();
|
|
req.originalUrl = "/api/xxxx";
|
|
req.app = {};
|
|
req.session = {
|
|
auth: {
|
|
userid: "user",
|
|
first_factor: true,
|
|
second_factor: false,
|
|
identity_check: {
|
|
challenge: "u2f-register",
|
|
userid: "user"
|
|
}
|
|
}
|
|
};
|
|
req.headers = {};
|
|
req.headers.host = "localhost";
|
|
|
|
const s = ServerVariablesMockBuilder.build();
|
|
mocks = s.mocks;
|
|
vars = s.variables;
|
|
|
|
const options = {
|
|
inMemoryOnly: true
|
|
};
|
|
|
|
res = ExpressMock.ResponseMock();
|
|
res.send = sinon.spy();
|
|
res.json = sinon.spy();
|
|
res.status = sinon.spy();
|
|
});
|
|
|
|
it("should send back the sign request and save it in the session", function () {
|
|
const expectedRequest: U2f.RegistrationResult = {
|
|
keyHandle: "keyHandle",
|
|
publicKey: "publicKey",
|
|
certificate: "Certificate",
|
|
successful: true
|
|
};
|
|
mocks.u2f.requestStub.returns(expectedRequest);
|
|
mocks.userDataStore.retrieveU2FRegistrationStub.returns(BluebirdPromise.resolve({
|
|
registration: {
|
|
publicKey: "PUBKEY",
|
|
keyHandle: "KeyHandle"
|
|
}
|
|
}));
|
|
|
|
return U2FSignRequestGet.default(vars)(req as any, res as any)
|
|
.then(function () {
|
|
assert.deepEqual(expectedRequest, req.session.auth.sign_request);
|
|
assert.deepEqual(expectedRequest, res.json.getCall(0).args[0].request);
|
|
});
|
|
});
|
|
});
|
|
|