-
-
Notifications
You must be signed in to change notification settings - Fork 787
/
test_token_revocation.py
144 lines (120 loc) · 6.04 KB
/
test_token_revocation.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
from __future__ import unicode_literals
import datetime
from django.test import TestCase, RequestFactory
from django.core.urlresolvers import reverse
from django.utils import timezone
from ..compat import urlencode, get_user_model
from ..models import get_application_model, AccessToken, RefreshToken
from ..settings import oauth2_settings
from .test_utils import TestCaseUtils
Application = get_application_model()
UserModel = get_user_model()
class BaseTest(TestCaseUtils, TestCase):
def setUp(self):
self.factory = RequestFactory()
self.test_user = UserModel.objects.create_user("test_user", "test@user.com", "123456")
self.dev_user = UserModel.objects.create_user("dev_user", "dev@user.com", "123456")
self.application = Application(
name="Test Application",
redirect_uris="http://localhost http://example.com http://example.it",
user=self.dev_user,
client_type=Application.CLIENT_CONFIDENTIAL,
authorization_grant_type=Application.GRANT_AUTHORIZATION_CODE,
)
self.application.save()
oauth2_settings._SCOPES = ['read', 'write']
def tearDown(self):
self.application.delete()
self.test_user.delete()
self.dev_user.delete()
class TestRevocationView(BaseTest):
def test_revoke_access_token(self):
"""
"""
tok = AccessToken.objects.create(user=self.test_user, token='1234567890',
application=self.application,
expires=timezone.now()+datetime.timedelta(days=1),
scope='read write')
query_string = urlencode({
'client_id': self.application.client_id,
'client_secret': self.application.client_secret,
'token': tok.token,
})
url = "{url}?{qs}".format(url=reverse('oauth2_provider:revoke-token'), qs=query_string)
response = self.client.post(url)
self.assertEqual(response.status_code, 200)
self.assertEqual(response.content, b'')
self.assertFalse(AccessToken.objects.filter(id=tok.id).exists())
def test_revoke_access_token_with_hint(self):
"""
"""
tok = AccessToken.objects.create(user=self.test_user, token='1234567890',
application=self.application,
expires=timezone.now()+datetime.timedelta(days=1),
scope='read write')
query_string = urlencode({
'client_id': self.application.client_id,
'client_secret': self.application.client_secret,
'token': tok.token,
'token_type_hint': 'access_token'
})
url = "{url}?{qs}".format(url=reverse('oauth2_provider:revoke-token'), qs=query_string)
response = self.client.post(url)
self.assertEqual(response.status_code, 200)
self.assertFalse(AccessToken.objects.filter(id=tok.id).exists())
def test_revoke_access_token_with_invalid_hint(self):
"""
"""
tok = AccessToken.objects.create(user=self.test_user, token='1234567890',
application=self.application,
expires=timezone.now()+datetime.timedelta(days=1),
scope='read write')
# invalid hint should have no effect
query_string = urlencode({
'client_id': self.application.client_id,
'client_secret': self.application.client_secret,
'token': tok.token,
'token_type_hint': 'bad_hint'
})
url = "{url}?{qs}".format(url=reverse('oauth2_provider:revoke-token'), qs=query_string)
response = self.client.post(url)
self.assertEqual(response.status_code, 200)
self.assertFalse(AccessToken.objects.filter(id=tok.id).exists())
def test_revoke_refresh_token(self):
"""
"""
tok = AccessToken.objects.create(user=self.test_user, token='1234567890',
application=self.application,
expires=timezone.now()+datetime.timedelta(days=1),
scope='read write')
rtok = RefreshToken.objects.create(user=self.test_user, token='999999999',
application=self.application, access_token=tok)
query_string = urlencode({
'client_id': self.application.client_id,
'client_secret': self.application.client_secret,
'token': rtok.token,
})
url = "{url}?{qs}".format(url=reverse('oauth2_provider:revoke-token'), qs=query_string)
response = self.client.post(url)
self.assertEqual(response.status_code, 200)
self.assertFalse(RefreshToken.objects.filter(id=rtok.id).exists())
def test_revoke_token_with_wrong_hint(self):
"""
From the revocation rfc, `Section 4.1.2`_ :
If the server is unable to locate the token using the given hint, it MUST extend its search across all of its supported token typeso
.. _`Section 4.1.2`: http://tools.ietf.org/html/draft-ietf-oauth-revocation-11#section-4.1.2
"""
tok = AccessToken.objects.create(user=self.test_user, token='1234567890',
application=self.application,
expires=timezone.now()+datetime.timedelta(days=1),
scope='read write')
query_string = urlencode({
'client_id': self.application.client_id,
'client_secret': self.application.client_secret,
'token': tok.token,
'token_type_hint': 'refresh_token'
})
url = "{url}?{qs}".format(url=reverse('oauth2_provider:revoke-token'), qs=query_string)
response = self.client.post(url)
self.assertEqual(response.status_code, 200)
self.assertFalse(AccessToken.objects.filter(id=tok.id).exists())