Function TestBasicAuthWithSessionCookie

rest/session_test.go:172–210

Test for issue 758 - basic auth with stale session cookie

(t *testing.T)

// Test for issue 758 - basic auth with stale session cookie
func TestBasicAuthWithSessionCookie(t *testing.T) {

	rt := NewRestTester(t, &RestTesterConfig{SyncFn: channels.DocChannelsSyncFunction})
	defer rt.Close()

	// Create two users
	rt.CreateUser("bernard", []string{"bernard"})
	rt.CreateUser("manny", []string{"manny"})

	// Create a session for the first user
	response := rt.Send(RequestByUser("POST", "/db/_session", `{"name":"bernard", "password":"letmein"}`, "bernard"))
	log.Println("response.Header()", response.Header())
	assert.True(t, response.Header().Get("Set-Cookie") != "")

	cookie := response.Header().Get("Set-Cookie")

	// Create a doc as the first user, with session auth, channel-restricted to first user
	reqHeaders := map[string]string{
		"Cookie": cookie,
	}
	response = rt.SendRequestWithHeaders("PUT", "/{{.keyspace}}/bernardDoc", `{"hi": "there", "channels":["bernard"]}`, reqHeaders)
	RequireStatus(t, response, 201)
	response = rt.SendRequestWithHeaders("GET", "/{{.keyspace}}/bernardDoc", "", reqHeaders)
	RequireStatus(t, response, 200)

	// Create a doc as the second user, with basic auth, channel-restricted to the second user
	response = rt.SendUserRequest("PUT", "/{{.keyspace}}/mannyDoc", `{"hi": "there", "channels":["manny"]}`, "manny")
	RequireStatus(t, response, 201)
	response = rt.SendUserRequest("GET", "/{{.keyspace}}/mannyDoc", "", "manny")
	RequireStatus(t, response, 200)
	response = rt.SendUserRequest("GET", "/{{.keyspace}}/bernardDoc", "", "manny")
	RequireStatus(t, response, 403)

	// Attempt to retrieve the docs with the first user's cookie, second user's basic auth credentials.  Basic Auth should take precedence
	response = rt.SendUserRequestWithHeaders("GET", "/{{.keyspace}}/bernardDoc", "", reqHeaders, "manny", "letmein")
	RequireStatus(t, response, 403)
	response = rt.SendUserRequestWithHeaders("GET", "/{{.keyspace}}/mannyDoc", "", reqHeaders, "manny", "letmein")
	RequireStatus(t, response, 200)
}

// Try to create session with invalid cert but valid credentials
func TestSessionFail(t *testing.T) {