84a35c90e9
After OIDC login, if the redirect targets a trust center custom domain, the callback now redirects through a session-transfer endpoint on that domain. The endpoint verifies an HMAC-signed, time-limited token and sets the session cookie on the custom domain before redirecting to the final URL. The continue URL is bound into the signed token payload to prevent open-redirect attacks via parameter tampering. Signed-off-by: Bryan Frimin <bryan@getprobo.com>
74 lines
2.3 KiB
Go
74 lines
2.3 KiB
Go
// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
|
|
//
|
|
// Permission to use, copy, modify, and/or distribute this software for any
|
|
// purpose with or without fee is hereby granted, provided that the above
|
|
// copyright notice and this permission notice appear in all copies.
|
|
//
|
|
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
|
|
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
|
|
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
|
|
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
|
|
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
|
|
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
|
|
// PERFORMANCE OF THIS SOFTWARE.
|
|
|
|
package authn
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func TestSignAndVerifySessionTransfer(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
secret := "test-secret-key"
|
|
sessionID := "ses_abc123"
|
|
continueURL := "https://custom.example.com/compliance"
|
|
|
|
token, err := SignSessionTransfer(sessionID, continueURL, secret)
|
|
require.NoError(t, err)
|
|
require.NotEmpty(t, token)
|
|
|
|
claims, err := VerifySessionTransfer(token, secret)
|
|
require.NoError(t, err)
|
|
assert.Equal(t, sessionID, claims.SessionID)
|
|
assert.Equal(t, continueURL, claims.ContinueURL)
|
|
}
|
|
|
|
func TestVerifySessionTransfer_WrongSecret(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
token, err := SignSessionTransfer("ses_abc123", "https://example.com", "secret-a")
|
|
require.NoError(t, err)
|
|
|
|
_, err = VerifySessionTransfer(token, "secret-b")
|
|
assert.ErrorIs(t, err, ErrInvalidSessionTransferToken)
|
|
}
|
|
|
|
func TestVerifySessionTransfer_TamperedToken(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
token, err := SignSessionTransfer("ses_abc123", "https://example.com", "secret")
|
|
require.NoError(t, err)
|
|
|
|
_, err = VerifySessionTransfer(token+"x", "secret")
|
|
assert.ErrorIs(t, err, ErrInvalidSessionTransferToken)
|
|
}
|
|
|
|
func TestVerifySessionTransfer_MalformedToken(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
_, err := VerifySessionTransfer("not-a-valid-token", "secret")
|
|
assert.ErrorIs(t, err, ErrInvalidSessionTransferToken)
|
|
}
|
|
|
|
func TestSignSessionTransfer_EmptySecret(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
_, err := SignSessionTransfer("ses_abc123", "https://example.com", "")
|
|
assert.Error(t, err)
|
|
}
|