Download this file
| 1 | package home |
| 2 | |
| 3 | import ( |
| 4 | "net/http" |
| 5 | "strings" |
| 6 | "testing" |
| 7 | ) |
| 8 | |
| 9 | func TestKeymailSignInContinuesWithoutExternalPostRedirect(t *testing.T) { |
| 10 | app := newTestApp(t) |
| 11 | const addr = "person@keymail.invalid" |
| 12 | stub := newKeymailStub(t, app, addr) |
| 13 | policy := app.SecurityPolicy() |
| 14 | rec := signIn(t, app, addr) |
| 15 | if rec.Code != http.StatusOK { |
| 16 | t.Fatalf("POST sign-in must end before external navigation: %d", rec.Code) |
| 17 | } |
| 18 | refresh, links := continuationTargets(t, rec.Body.String()) |
| 19 | if len(links) != 1 || len(refresh) != 1 || !strings.HasPrefix(links[0], stub.srv.URL+"/") { |
| 20 | t.Fatal("missing exact provider continuation") |
| 21 | } |
| 22 | assertContinuationPage(t, rec, links[0]) |
| 23 | if app.SecurityPolicy() != policy || strings.Contains(policy, stub.host) { |
| 24 | t.Fatal("CSP broadened to provider") |
| 25 | } |
| 26 | if sessionCookie(rec) != nil { |
| 27 | t.Fatal("continuation minted a session") |
| 28 | } |
| 29 | var pending *http.Cookie |
| 30 | for _, c := range rec.Result().Cookies() { |
| 31 | if c.Name == pendingCookie { |
| 32 | pending = c |
| 33 | } |
| 34 | } |
| 35 | if pending == nil || pending.Value == "" || !pending.HttpOnly || !pending.Secure || pending.SameSite != http.SameSiteLaxMode { |
| 36 | t.Fatal("pending cookie lost") |
| 37 | } |
| 38 | } |
| 39 | |
amadan