Function TestHtmlFormLogin

lib/api/api_test.go:841–981

(t *testing.T)

}

func TestHtmlFormLogin(t *testing.T) {
	t.Parallel()

	cfg := newMockedConfig()
	cfg.GUIReturns(config.GUIConfiguration{
		User:                "üser",
		Password:            "$2a$10$IdIZTxTg/dCNuNEGlmLynOjqg4B1FvDKuIV5e0BB3pnWVHNb8.GSq", // bcrypt of "räksmörgås" in UTF-8
		SendBasicAuthPrompt: false,
	})
	baseURL := startHTTP(t, cfg)

	loginUrl := baseURL + "/rest/noauth/auth/password"
	resourceUrl := baseURL + "/meta.js"
	resourceUrl404 := baseURL + "/any-path/that/does/nooooooot/match-any/noauth-pattern"

	performLogin := func(username string, password string) *http.Response {
		t.Helper()
		return httpPost(loginUrl, map[string]string{"username": username, "password": password}, nil, t)
	}

	performResourceRequest := func(url string, cookies []*http.Cookie) *http.Response {
		t.Helper()
		return httpGet(url, "", "", "", "", cookies, t)
	}

	testNoAuthPath := func(noAuthPath string) {
		t.Run("auth is not needed for "+noAuthPath, func(t *testing.T) {
			t.Parallel()
			resp := httpGet(baseURL+noAuthPath, "", "", "", "", nil, t)
			if resp.StatusCode != http.StatusOK {
				t.Errorf("Unexpected non-200 return code %d at %s", resp.StatusCode, noAuthPath)
			}
			if hasSessionCookie(resp.Cookies()) {
				t.Errorf("Unexpected session cookie at %s", noAuthPath)
			}
		})
	}
	testNoAuthPath("/index.html")
	testNoAuthPath("/rest/svc/lang")

	t.Run("incorrect password is rejected with 403", func(t *testing.T) {
		t.Parallel()
		resp := performLogin("üser", "rksmrgs") // string literals in Go source code are in UTF-8
		if resp.StatusCode != http.StatusForbidden {
			t.Errorf("Unexpected non-403 return code %d for incorrect password", resp.StatusCode)
		}
		if hasSessionCookie(resp.Cookies()) {
			t.Errorf("Unexpected session cookie for incorrect password")
		}
		resp = performResourceRequest(resourceUrl, resp.Cookies())
		if resp.StatusCode != http.StatusForbidden {
			t.Errorf("Unexpected non-403 return code %d for incorrect password", resp.StatusCode)
		}
	})

	t.Run("incorrect username is rejected with 403", func(t *testing.T) {
		t.Parallel()
		resp := performLogin("user", "räksmörgås") // string literals in Go source code are in UTF-8