TestHTTP_Token_BadPKCE confirms fosite rejects a wrong verifier at the HTTP boundary with invalid_grant per RFC 6749 §5.2.
(t *testing.T)
| 268 | // TestHTTP_Token_BadPKCE confirms fosite rejects a wrong verifier at |
| 269 | // the HTTP boundary with invalid_grant per RFC 6749 §5.2. |
| 270 | func TestHTTP_Token_BadPKCE(t *testing.T) { |
| 271 | server, provider, _, clientID, userID := setupOAuthAPI(t) |
| 272 | redirectURI := "http://localhost:8765/callback" |
| 273 | _, challenge := newPKCE(t) |
| 274 | code := mintAuthCode(t, provider, clientID, userID, redirectURI, challenge) |
| 275 | |
| 276 | form := url.Values{} |
| 277 | form.Set("grant_type", "authorization_code") |
| 278 | form.Set("code", code) |
| 279 | form.Set("client_id", clientID) |
| 280 | form.Set("redirect_uri", redirectURI) |
| 281 | form.Set("code_verifier", "not-the-right-verifier-not-the-right-verifier") |
| 282 | |
| 283 | resp, err := http.Post(server.URL+"/oauth2/token", |
| 284 | "application/x-www-form-urlencoded", strings.NewReader(form.Encode())) |
| 285 | if err != nil { |
| 286 | t.Fatal(err) |
| 287 | } |
| 288 | defer resp.Body.Close() |
| 289 | if resp.StatusCode != http.StatusBadRequest { |
| 290 | t.Fatalf("status = %d, want 400 invalid_grant", resp.StatusCode) |
| 291 | } |
| 292 | var body struct { |
| 293 | Error string `json:"error"` |
| 294 | } |
| 295 | json.NewDecoder(resp.Body).Decode(&body) |
| 296 | if body.Error != "invalid_grant" { |
| 297 | t.Errorf("error = %q, want invalid_grant", body.Error) |
| 298 | } |
| 299 | } |
| 300 | |
| 301 | // TestHTTP_Token_CodeReplay drives the code-reuse path: exchange |
| 302 | // once (success), then re-present the same code (rejection + the |
nothing calls this directly
no test coverage detected