mirror of
https://github.com/wassname/flask-security.git
synced 2026-06-27 16:10:11 +08:00
Nuno Santos
3681823fcf
When using @http_auth_required, the WWW-Authenticate header is included,
but when using @auth_required('basic'), it is not. This change includes
that header in every @auth_required call that contains the 'basic'
method.
293 lines
9.7 KiB
Python
293 lines
9.7 KiB
Python
# -*- coding: utf-8 -*-
|
|
"""
|
|
test_common
|
|
~~~~~~~~~~~
|
|
|
|
Test common functionality
|
|
"""
|
|
|
|
import base64
|
|
|
|
try:
|
|
from cookielib import Cookie
|
|
except ImportError:
|
|
from http.cookiejar import Cookie
|
|
|
|
from utils import authenticate, json_authenticate, logout
|
|
|
|
|
|
def test_login_view(client):
|
|
response = client.get('/login')
|
|
assert b'<h1>Login</h1>' in response.data
|
|
|
|
|
|
def test_authenticate(client):
|
|
response = authenticate(client)
|
|
assert response.status_code == 302
|
|
response = authenticate(client, follow_redirects=True)
|
|
assert b'Hello matt@lp.com' in response.data
|
|
|
|
|
|
def test_authenticate_with_next(client):
|
|
data = dict(email='matt@lp.com', password='password')
|
|
response = client.post('/login?next=/page1', data=data, follow_redirects=True)
|
|
assert b'Page 1' in response.data
|
|
|
|
|
|
def test_authenticate_with_invalid_next(client, get_message):
|
|
data = dict(email='matt@lp.com', password='password')
|
|
response = client.post('/login?next=http://google.com', data=data)
|
|
assert get_message('INVALID_REDIRECT') in response.data
|
|
|
|
|
|
def test_authenticate_with_invalid_malformed_next(client, get_message):
|
|
data = dict(email='matt@lp.com', password='password')
|
|
response = client.post('/login?next=http:///google.com', data=data)
|
|
assert get_message('INVALID_REDIRECT') in response.data
|
|
|
|
|
|
def test_authenticate_case_insensitive_email(app, client):
|
|
response = authenticate(client, 'MATT@lp.com', follow_redirects=True)
|
|
assert b'Hello matt@lp.com' in response.data
|
|
|
|
|
|
def test_unprovided_username(client, get_message):
|
|
response = authenticate(client, "")
|
|
assert get_message('EMAIL_NOT_PROVIDED') in response.data
|
|
|
|
|
|
def test_unprovided_password(client, get_message):
|
|
response = authenticate(client, password="")
|
|
assert get_message('PASSWORD_NOT_PROVIDED') in response.data
|
|
|
|
|
|
def test_invalid_user(client, get_message):
|
|
response = authenticate(client, email="bogus@bogus.com")
|
|
assert get_message('USER_DOES_NOT_EXIST') in response.data
|
|
|
|
|
|
def test_bad_password(client, get_message):
|
|
response = authenticate(client, password="bogus")
|
|
assert get_message('INVALID_PASSWORD') in response.data
|
|
|
|
|
|
def test_inactive_user(client, get_message):
|
|
response = authenticate(client, "tiya@lp.com", "password")
|
|
assert get_message('DISABLED_ACCOUNT') in response.data
|
|
|
|
|
|
def test_unset_password(client, get_message):
|
|
response = authenticate(client, "jess@lp.com", "password")
|
|
assert get_message('PASSWORD_NOT_SET') in response.data
|
|
|
|
|
|
def test_logout(client):
|
|
authenticate(client)
|
|
response = logout(client, follow_redirects=True)
|
|
assert b'Home Page' in response.data
|
|
|
|
|
|
def test_missing_session_access(client, get_message):
|
|
response = client.get('/profile', follow_redirects=True)
|
|
assert get_message('LOGIN') in response.data
|
|
|
|
|
|
def test_has_session_access(client):
|
|
authenticate(client)
|
|
response = client.get("/profile", follow_redirects=True)
|
|
assert b'profile' in response.data
|
|
|
|
|
|
def test_authorized_access(client):
|
|
authenticate(client)
|
|
response = client.get("/admin")
|
|
assert b'Admin Page' in response.data
|
|
|
|
|
|
def test_unauthorized_access(client, get_message):
|
|
authenticate(client, "joe@lp.com")
|
|
response = client.get("/admin", follow_redirects=True)
|
|
assert get_message('UNAUTHORIZED') in response.data
|
|
|
|
|
|
def test_roles_accepted(client):
|
|
for user in ("matt@lp.com", "joe@lp.com"):
|
|
authenticate(client, user)
|
|
response = client.get("/admin_or_editor")
|
|
assert b'Admin or Editor Page' in response.data
|
|
logout(client)
|
|
|
|
authenticate(client, "jill@lp.com")
|
|
response = client.get("/admin_or_editor", follow_redirects=True)
|
|
assert b'Home Page' in response.data
|
|
|
|
|
|
def test_unauthenticated_role_required(client, get_message):
|
|
response = client.get('/admin', follow_redirects=True)
|
|
assert get_message('UNAUTHORIZED') in response.data
|
|
|
|
|
|
def test_multiple_role_required(client):
|
|
for user in ("matt@lp.com", "joe@lp.com"):
|
|
authenticate(client, user)
|
|
response = client.get("/admin_and_editor", follow_redirects=True)
|
|
assert b'Home Page' in response.data
|
|
client.get('/logout')
|
|
|
|
authenticate(client, 'dave@lp.com')
|
|
response = client.get("/admin_and_editor", follow_redirects=True)
|
|
assert b'Admin and Editor Page' in response.data
|
|
|
|
|
|
def test_ok_json_auth(client):
|
|
response = json_authenticate(client)
|
|
assert response.jdata['meta']['code'] == 200
|
|
assert 'authentication_token' in response.jdata['response']['user']
|
|
|
|
|
|
def test_invalid_json_auth(client):
|
|
response = json_authenticate(client, password='junk')
|
|
assert b'"code": 400' in response.data
|
|
|
|
|
|
def test_token_auth_via_querystring_valid_token(client):
|
|
response = json_authenticate(client)
|
|
token = response.jdata['response']['user']['authentication_token']
|
|
response = client.get('/token?auth_token=' + token)
|
|
assert b'Token Authentication' in response.data
|
|
|
|
|
|
def test_token_auth_via_header_valid_token(client):
|
|
response = json_authenticate(client)
|
|
token = response.jdata['response']['user']['authentication_token']
|
|
headers = {"Authentication-Token": token}
|
|
response = client.get('/token', headers=headers)
|
|
assert b'Token Authentication' in response.data
|
|
|
|
|
|
def test_token_auth_via_querystring_invalid_token(client):
|
|
response = client.get('/token?auth_token=X')
|
|
assert 401 == response.status_code
|
|
|
|
|
|
def test_token_auth_via_header_invalid_token(client):
|
|
response = client.get('/token', headers={"Authentication-Token": 'X'})
|
|
assert 401 == response.status_code
|
|
|
|
|
|
def test_http_auth(client):
|
|
response = client.get('/http', headers={
|
|
'Authorization': 'Basic %s' % base64.b64encode(b"joe@lp.com:password").decode('utf-8')
|
|
})
|
|
assert b'HTTP Authentication' in response.data
|
|
|
|
|
|
def test_http_auth_no_authorization(client):
|
|
response = client.get('/http', headers={})
|
|
assert b'<h1>Unauthorized</h1>' in response.data
|
|
assert 'WWW-Authenticate' in response.headers
|
|
assert 'Basic realm="Login Required"' == response.headers['WWW-Authenticate']
|
|
|
|
|
|
def test_invalid_http_auth_invalid_username(client):
|
|
response = client.get('/http', headers={
|
|
'Authorization': 'Basic %s' % base64.b64encode(b"bogus:bogus").decode('utf-8')
|
|
})
|
|
assert b'<h1>Unauthorized</h1>' in response.data
|
|
assert 'WWW-Authenticate' in response.headers
|
|
assert 'Basic realm="Login Required"' == response.headers['WWW-Authenticate']
|
|
|
|
|
|
def test_invalid_http_auth_bad_password(client):
|
|
response = client.get('/http', headers={
|
|
'Authorization': 'Basic %s' % base64.b64encode(b"joe@lp.com:bogus").decode('utf-8')
|
|
})
|
|
assert b'<h1>Unauthorized</h1>' in response.data
|
|
assert 'WWW-Authenticate' in response.headers
|
|
assert 'Basic realm="Login Required"' == response.headers['WWW-Authenticate']
|
|
|
|
|
|
def test_custom_http_auth_realm(client):
|
|
response = client.get('/http_custom_realm', headers={
|
|
'Authorization': 'Basic %s' % base64.b64encode(b"joe@lp.com:bogus").decode('utf-8')
|
|
})
|
|
assert b'<h1>Unauthorized</h1>' in response.data
|
|
assert 'WWW-Authenticate' in response.headers
|
|
assert 'Basic realm="My Realm"' == response.headers['WWW-Authenticate']
|
|
|
|
|
|
def test_multi_auth_basic(client):
|
|
response = client.get('/multi_auth', headers={
|
|
'Authorization': 'Basic %s' % base64.b64encode(b"joe@lp.com:password").decode('utf-8')
|
|
})
|
|
assert b'Basic' in response.data
|
|
|
|
response = client.get('/multi_auth')
|
|
assert response.status_code == 401
|
|
|
|
|
|
def test_multi_auth_basic_invalid(client):
|
|
response = client.get('/multi_auth', headers={
|
|
'Authorization': 'Basic %s' % base64.b64encode(b"bogus:bogus").decode('utf-8')
|
|
})
|
|
assert b'<h1>Unauthorized</h1>' in response.data
|
|
assert 'WWW-Authenticate' in response.headers
|
|
assert 'Basic realm="Login Required"' == response.headers['WWW-Authenticate']
|
|
|
|
response = client.get('/multi_auth')
|
|
print(response.headers)
|
|
assert response.status_code == 401
|
|
|
|
|
|
def test_multi_auth_token(client):
|
|
response = json_authenticate(client)
|
|
token = response.jdata['response']['user']['authentication_token']
|
|
response = client.get('/multi_auth?auth_token=' + token)
|
|
assert b'Token' in response.data
|
|
|
|
|
|
def test_multi_auth_session(client):
|
|
authenticate(client, )
|
|
response = client.get('/multi_auth')
|
|
assert b'Session' in response.data
|
|
|
|
|
|
def test_user_deleted_during_session_reverts_to_anonymous_user(app, client):
|
|
authenticate(client)
|
|
|
|
with app.test_request_context('/'):
|
|
user = app.security.datastore.find_user(email='matt@lp.com')
|
|
app.security.datastore.delete_user(user)
|
|
app.security.datastore.commit()
|
|
|
|
response = client.get('/')
|
|
assert b'Hello matt@lp.com' not in response.data
|
|
|
|
|
|
def test_remember_token(client):
|
|
response = authenticate(client, follow_redirects=False)
|
|
client.cookie_jar.clear_session_cookies()
|
|
response = client.get('/profile')
|
|
assert b'profile' in response.data
|
|
|
|
|
|
def test_token_loader_does_not_fail_with_invalid_token(client):
|
|
c = Cookie(version=0, name='remember_token', value='None', port=None,
|
|
port_specified=False, domain='www.example.com',
|
|
domain_specified=False, domain_initial_dot=False, path='/',
|
|
path_specified=True, secure=False, expires=None,
|
|
discard=True, comment=None, comment_url=None,
|
|
rest={'HttpOnly': None}, rfc2109=False)
|
|
|
|
client.cookie_jar.set_cookie(c)
|
|
response = client.get('/')
|
|
assert b'BadSignature' not in response.data
|
|
|
|
|
|
def test_sending_auth_token_with_json(client):
|
|
response = json_authenticate(client)
|
|
token = response.jdata['response']['user']['authentication_token']
|
|
data = '{"auth_token": "%s"}' % token
|
|
response = client.post('/token', data=data, headers={'Content-Type': 'application/json'})
|
|
assert b'Token Authentication' in response.data
|