authorize_helper_test.go

/*
 * Copyright © 2015-2018 Aeneas Rekkas <aeneas+oss@aeneas.io>
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 *
 * @author		Aeneas Rekkas <aeneas+oss@aeneas.io>
 * @copyright 	2015-2018 Aeneas Rekkas <aeneas+oss@aeneas.io>
 * @license 	Apache-2.0
 *
 */

package fosite

import (
	"net/url"
	"testing"

	"github.com/stretchr/testify/assert"
	"github.com/stretchr/testify/require"
)

func TestIsLocalhost(t *testing.T) {
	for k, c := range []struct {
		expect bool
		rawurl string
	}{
		{expect: false, rawurl: "https://foo.bar"},
		{expect: true, rawurl: "https://localhost"},
		{expect: true, rawurl: "https://localhost:1234"},
		{expect: true, rawurl: "https://127.0.0.1:1234"},
		{expect: true, rawurl: "https://127.0.0.1"},
		{expect: true, rawurl: "https://test.localhost:1234"},
		{expect: true, rawurl: "https://test.localhost"},
	} {
		u, _ := url.Parse(c.rawurl)
		assert.Equal(t, c.expect, IsLocalhost(u), "case %d", k)
	}
}

// rfc6749 10.6.
// Authorization Code Redirection URI Manipulation
// The authorization server	MUST require public clients and SHOULD require confidential clients
// to register their redirection URIs.  If a redirection URI is provided
// in the request, the authorization server MUST validate it against the
// registered value.
//
// rfc6819 4.4.1.7.
// Threat: Authorization "code" Leakage through Counterfeit Client
// The authorization server may also enforce the usage and validation
// of pre-registered redirect URIs (see Section 5.2.3.5).
func TestDoesClientWhiteListRedirect(t *testing.T) {
	for k, c := range []struct {
		client   Client
		url      string
		isError  bool
		expected string
	}{
		{
			client:  &DefaultClient{RedirectURIs: []string{""}},
			url:     "https://foo.com/cb",
			isError: true,
		},
		{
			client:   &DefaultClient{RedirectURIs: []string{"wta://auth"}},
			url:      "wta://auth",
			expected: "wta://auth",
			isError:  false,
		},
		{
			client:   &DefaultClient{RedirectURIs: []string{"wta:///auth"}},
			url:      "wta:///auth",
			expected: "wta:///auth",
			isError:  false,
		},
		{
			client:   &DefaultClient{RedirectURIs: []string{"wta://foo/auth"}},
			url:      "wta://foo/auth",
			expected: "wta://foo/auth",
			isError:  false,
		},
		{
			client:  &DefaultClient{RedirectURIs: []string{"https://bar.com/cb"}},
			url:     "https://foo.com/cb",
			isError: true,
		},
		{
			client:   &DefaultClient{RedirectURIs: []string{"https://bar.com/cb"}},
			url:      "",
			isError:  false,
			expected: "https://bar.com/cb",
		},
		{
			client:  &DefaultClient{RedirectURIs: []string{""}},
			url:     "",
			isError: true,
		},
		{
			client:   &DefaultClient{RedirectURIs: []string{"https://bar.com/cb"}},
			url:      "https://bar.com/cb",
			isError:  false,
			expected: "https://bar.com/cb",
		},
		{
			client:  &DefaultClient{RedirectURIs: []string{"https://bar.com/cb"}},
			url:     "https://bar.com/cb123",
			isError: true,
		},
		{
			client:   &DefaultClient{RedirectURIs: []string{"http://[::1]"}},
			url:      "http://[::1]:1024",
			expected: "http://[::1]:1024",
			isError:  false,
		},
		{
			client:  &DefaultClient{RedirectURIs: []string{"http://[::1]"}},
			url:     "http://[::1]:1024/cb",
			isError: true,
		},
		{
			client:   &DefaultClient{RedirectURIs: []string{"http://[::1]/cb"}},
			url:      "http://[::1]:1024/cb",
			expected: "http://[::1]:1024/cb",
			isError:  false,
		},
		{
			client:  &DefaultClient{RedirectURIs: []string{"http://[::1]"}},
			url:     "http://foo.bar/bar",
			isError: true,
		},
		{
			client:   &DefaultClient{RedirectURIs: []string{"http://127.0.0.1"}},
			url:      "http://127.0.0.1:1024",
			expected: "http://127.0.0.1:1024",
			isError:  false,
		},
		{
			client:   &DefaultClient{RedirectURIs: []string{"http://127.0.0.1/cb"}},
			url:      "http://127.0.0.1:64000/cb",
			expected: "http://127.0.0.1:64000/cb",
			isError:  false,
		},
		{
			client:  &DefaultClient{RedirectURIs: []string{"http://127.0.0.1"}},
			url:     "http://127.0.0.1:64000/cb",
			isError: true,
		},
		{
			client:   &DefaultClient{RedirectURIs: []string{"http://127.0.0.1"}},
			url:      "http://127.0.0.1",
			expected: "http://127.0.0.1",
			isError:  false,
		},
		{
			client:   &DefaultClient{RedirectURIs: []string{"http://127.0.0.1/Cb"}},
			url:      "http://127.0.0.1:8080/Cb",
			expected: "http://127.0.0.1:8080/Cb",
			isError:  false,
		},
		{
			client:  &DefaultClient{RedirectURIs: []string{"http://127.0.0.1"}},
			url:     "http://foo.bar/bar",
			isError: true,
		},
		{
			client:  &DefaultClient{RedirectURIs: []string{"http://127.0.0.1"}},
			url:     ":/invalid.uri)bar",
			isError: true,
		},
		{
			client:  &DefaultClient{RedirectURIs: []string{"http://127.0.0.1:8080/cb"}},
			url:     "http://127.0.0.1:8080/Cb",
			isError: true,
		},
		{
			client:  &DefaultClient{RedirectURIs: []string{"http://127.0.0.1:8080/cb"}},
			url:     "http://127.0.0.1:8080/cb?foo=bar",
			isError: true,
		},
		{
			client:   &DefaultClient{RedirectURIs: []string{"http://127.0.0.1:8080/cb?foo=bar"}},
			url:      "http://127.0.0.1:8080/cb?foo=bar",
			expected: "http://127.0.0.1:8080/cb?foo=bar",
			isError:  false,
		},
		{
			client:  &DefaultClient{RedirectURIs: []string{"http://127.0.0.1:8080/cb?foo=bar"}},
			url:     "http://127.0.0.1:8080/cb?baz=bar&foo=bar",
			isError: true,
		},
		{
			client:  &DefaultClient{RedirectURIs: []string{"http://127.0.0.1:8080/cb?foo=bar&baz=bar"}},
			url:     "http://127.0.0.1:8080/cb?baz=bar&foo=bar",
			isError: true,
		},
		{
			client:  &DefaultClient{RedirectURIs: []string{"https://www.ory.sh/cb"}},
			url:     "http://127.0.0.1:8080/cb",
			isError: true,
		},
		{
			client:  &DefaultClient{RedirectURIs: []string{"http://127.0.0.1:8080/cb"}},
			url:     "https://www.ory.sh/cb",
			isError: true,
		},
		{
			client:   &DefaultClient{RedirectURIs: []string{"web+application://callback"}},
			url:      "web+application://callback",
			isError:  false,
			expected: "web+application://callback",
		},
		{
			client:   &DefaultClient{RedirectURIs: []string{"https://google.com/?foo=bar%20foo+baz"}},
			url:      "https://google.com/?foo=bar%20foo+baz",
			isError:  false,
			expected: "https://google.com/?foo=bar%20foo+baz",
		},
	} {
		redir, err := MatchRedirectURIWithClientRedirectURIs(c.url, c.client)
		assert.Equal(t, c.isError, err != nil, "%d: %+v", k, c)
		if err == nil {
			require.NotNil(t, redir, "%d", k)
			assert.Equal(t, c.expected, redir.String(), "%d", k)
		}
		t.Logf("Passed test case %d", k)
	}
}

func TestIsRedirectURISecure(t *testing.T) {
	for d, c := range []struct {
		u   string
		err bool
	}{
		{u: "http://google.com", err: true},
		{u: "https://google.com", err: false},
		{u: "http://localhost", err: false},
		{u: "http://test.localhost", err: false},
		{u: "http://127.0.0.1/", err: false},
		{u: "http://[::1]/", err: false},
		{u: "http://127.0.0.1:8080/", err: false},
		{u: "http://[::1]:8080/", err: false},
		{u: "http://testlocalhost", err: true},
		{u: "wta://auth", err: false},
	} {
		uu, err := url.Parse(c.u)
		require.NoError(t, err)
		assert.Equal(t, !c.err, IsRedirectURISecure(uu), "case %d", d)
	}
}

func TestIsRedirectURISecureStrict(t *testing.T) {
	for d, c := range []struct {
		u   string
		err bool
	}{
		{u: "http://google.com", err: true},
		{u: "https://google.com", err: false},
		{u: "http://localhost", err: false},
		{u: "http://test.localhost", err: false},
		{u: "http://127.0.0.1/", err: false},
		{u: "http://[::1]/", err: false},
		{u: "http://127.0.0.1:8080/", err: false},
		{u: "http://[::1]:8080/", err: false},
		{u: "http://testlocalhost", err: true},
		{u: "wta://auth", err: true},
	} {
		uu, err := url.Parse(c.u)
		require.NoError(t, err)
		assert.Equal(t, !c.err, IsRedirectURISecureStrict(uu), "case %d", d)
	}
}