Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
ensure login test models correct behavior (#217)
With the release of tower-sessions `0.12.1`, we addressed a potential
security issue related to cycling session IDs. A side effect of that fix
is that we uncovered incorrect modeling of the login behavior within our
login test in axum-login.
Our login test is intended to assert, among other things, that a
successful login will cycle the session ID. Previously, we checked that
the original session ID and the new session ID did not match. However,
this assumed behavior of tower-sessions that was incorrect (cycling an
ID should in fact set the session ID to `None`). Instead, the session ID
is only updated once the session is saved, e.g. by the tower-sessions
middleware, when it resolves a response.
Here we've addressed this by more closely modeling the middleware.
Closes #215.
- Loading branch information