mirror of
https://github.com/0rangebananaspy/authelia.git
synced 2024-09-14 22:47:21 +07:00
7128970a53
Before this fix, the redirection URL was stored in the user session, but this has a big drawback since user could open several pages in browser and thus override the redirection URL leading the user to be incorrectly redirected.
47 lines
2.3 KiB
Gherkin
47 lines
2.3 KiB
Gherkin
Feature: User is correctly redirected
|
|
|
|
Scenario: User is redirected to authelia when he is not authenticated
|
|
Given I'm on https://home.test.local:8080
|
|
When I click on the link to secret.test.local
|
|
Then I'm redirected to "https://auth.test.local:8080/"
|
|
|
|
Scenario: User is redirected to home page after several authentication tries
|
|
Given I'm on https://auth.test.local:8080/
|
|
And I login with user "john" and password "password"
|
|
And I register a TOTP secret called "Sec0"
|
|
And I visit "https://public.test.local:8080/secret.html"
|
|
When I login with user "john" and password "badpassword"
|
|
And I clear field "username"
|
|
And I login with user "john" and password "password"
|
|
And I use "Sec0" as TOTP token handle
|
|
And I click on "TOTP"
|
|
Then I'm redirected to "https://public.test.local:8080/secret.html"
|
|
|
|
Scenario: User Harry does not have access to https://secret.test.local:8080/secret.html and thus he must get an error 401
|
|
When I register TOTP and login with user "harry" and password "password"
|
|
And I visit "https://secret.test.local:8080/secret.html"
|
|
Then I get an error 403
|
|
|
|
|
|
|
|
Scenario: Redirection URL is propagated from restricted page to first factor
|
|
When I visit "https://public.test.local:8080/secret.html"
|
|
Then I'm redirected to "https://auth.test.local:8080/?redirect=https%3A%2F%2Fpublic.test.local%3A8080%2Fsecret.html"
|
|
|
|
Scenario: Redirection URL is propagated from first factor to second factor
|
|
Given I visit "https://auth.test.local:8080/"
|
|
And I login with user "john" and password "password"
|
|
And I register a TOTP secret called "Sec0"
|
|
When I visit "https://public.test.local:8080/secret.html"
|
|
And I login with user "john" and password "password"
|
|
Then I'm redirected to "https://auth.test.local:8080/secondfactor?redirect=https%3A%2F%2Fpublic.test.local%3A8080%2Fsecret.html"
|
|
|
|
Scenario: Redirection URL is used to send user from second factor to target page
|
|
Given I visit "https://auth.test.local:8080/"
|
|
And I login with user "john" and password "password"
|
|
And I register a TOTP secret called "Sec0"
|
|
When I visit "https://public.test.local:8080/secret.html"
|
|
And I login with user "john" and password "password"
|
|
And I use "Sec0" as TOTP token handle
|
|
And I click on "TOTP"
|
|
Then I'm redirected to "https://public.test.local:8080/secret.html" |