jimmy/postgrest
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

correct: handle array values in JWT aud claim correctly

Browse Source
This commit is contained in:
Laurence Isla
2025-05-07 21:54:32 +00:00
parent b3bff90d68
commit e0c5b3a314
5 changed files with 253 additions and 38 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/spec/Feature/Auth/AudienceJwtSecretSpec.hs
+225 -30
View File
@@ -3,43 +3,238 @@ module Feature.Auth.AudienceJwtSecretSpec where
import Network.Wai (Application)
import Network.HTTP.Types
import Protolude hiding (get)
import SpecHelper
import Test.Hspec
import Test.Hspec.Wai
import Protolude hiding (get)
import SpecHelper
import Test.Hspec.Wai.JSON
spec :: SpecWith ((), Application)
spec = describe "test handling of aud claims in JWT" $ do
spec = describe "test handling of aud claims in JWT when the jwt-aud config is set" $ do
-- this test will stop working 9999999999s after the UNIX EPOCH
it "succeeds with jwt token containing with an audience claim" $ do
{- This is the decoded contents of authHeaderJWT
context "when the audience claim is a string" $ do
-- this test will stop working 9999999999s after the UNIX EPOCH
it "succeeds when the audience claim matches" $ do
let jwtPayload =
[json|{
"exp": 9999999999,
"role": "postgrest_test_author",
"id": "jdoe",
"aud": "youraudience"
}|]
auth = authHeaderJWT $ generateJWT jwtPayload
request methodGet "/authors_only" [auth] ""
`shouldRespondWith` 200
{
"exp": 9999999999,
"role": "postgrest_test_author",
"id": "jdoe",
"aud": "youraudience"
}
it "fails when the audience claim does not match" $ do
let jwtPayload = [json|
{
"exp": 9999999999,
"role": "postgrest_test_author",
"id": "jdoe",
"aud": "notyouraudience"
}|]
auth = authHeaderJWT $ generateJWT jwtPayload
request methodGet "/authors_only" [auth] ""
`shouldRespondWith`
[json|{"code":"PGRST303","details":null,"hint":null,"message":"JWT not in audience"}|]
{ matchStatus = 401 }
-}
let auth = authHeaderJWT "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjk5OTk5OTk5OTksInJvbGUiOiJwb3N0Z3Jlc3RfdGVzdF9hdXRob3IiLCJpZCI6Impkb2UiLCJhdWQiOiJ5b3VyYXVkaWVuY2UifQ.fJ4tLKSmolWGWehWN20qiU9dMO-WY0RI2VvacL7-ZGo"
request methodGet "/authors_only" [auth] ""
`shouldRespondWith` 200
it "fails when the audience claim is empty" $ do
let jwtPayload = [json|
{
"exp": 9999999999,
"role": "postgrest_test_author",
"id": "jdoe",
"aud": ""
}|]
auth = authHeaderJWT $ generateJWT jwtPayload
request methodGet "/authors_only" [auth] ""
`shouldRespondWith`
[json|{"code":"PGRST303","details":null,"hint":null,"message":"JWT not in audience"}|]
{ matchStatus = 401 }
it "succeeds with jwt token that does not contain an audience claim" $ do
{- This is the decoded contents of authHeaderJWT
context "when the audience claim is an array of strings" $ do
it "succeeds when the audience claim has 1 element and it matches" $ do
let jwtPayload = [json|
{
"exp": 9999999999,
"role": "postgrest_test_author",
"id": "jdoe",
"aud": ["youraudience"]
}|]
auth = authHeaderJWT $ generateJWT jwtPayload
request methodGet "/authors_only" [auth] ""
`shouldRespondWith` 200
{
"exp": 9999999999,
"role": "postgrest_test_author",
"id": "jdoe"
}
-}
let auth = authHeaderJWT "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjk5OTk5OTk5OTksInJvbGUiOiJwb3N0Z3Jlc3RfdGVzdF9hdXRob3IiLCJpZCI6Impkb2UifQ.Dpss-QoLYjec5OTsOaAc3FNVsSjA89wACoV-0ra3ClA"
request methodGet "/authors_only" [auth] ""
`shouldRespondWith` 200
it "succeeds when the audience claim has more than 1 element and one matches" $ do
let jwtPayload = [json|
{
"exp": 9999999999,
"role": "postgrest_test_author",
"id": "jdoe",
"aud": ["notyouraudience", "youraudience", "anotheraudience"]
}|]
auth = authHeaderJWT $ generateJWT jwtPayload
request methodGet "/authors_only" [auth] ""
`shouldRespondWith` 200
it "requests without JWT token should work" $
get "/has_count_column" `shouldRespondWith` 200
it "fails when the audience claim has 1 element and it doesn't match" $ do
let jwtPayload = [json|
{
"exp": 9999999999,
"role": "postgrest_test_author",
"id": "jdoe",
"aud": ["notyouraudience"]
}|]
auth = authHeaderJWT $ generateJWT jwtPayload
request methodGet "/authors_only" [auth] ""
`shouldRespondWith`
[json|{"code":"PGRST303","details":null,"hint":null,"message":"JWT not in audience"}|]
{ matchStatus = 401 }
it "fails when the audience claim has more than 1 element and none matches" $ do
let jwtPayload = [json|
{
"exp": 9999999999,
"role": "postgrest_test_author",
"id": "jdoe",
"aud": ["notyouraudience", "stillnotyouraudience", "anotheraudience"]
}|]
auth = authHeaderJWT $ generateJWT jwtPayload
request methodGet "/authors_only" [auth] ""
`shouldRespondWith`
[json|{"code":"PGRST303","details":null,"hint":null,"message":"JWT not in audience"}|]
{ matchStatus = 401 }
it "ignores the audience claim and succeeds when it's empty" $ do
let jwtPayload = [json|
{
"exp": 9999999999,
"role": "postgrest_test_author",
"id": "jdoe",
"aud": []
}|]
auth = authHeaderJWT $ generateJWT jwtPayload
request methodGet "/authors_only" [auth] ""
`shouldRespondWith` 200
it "ignores the audience claim and succeeds when it's null" $ do
let jwtPayload = [json|
{
"exp": 9999999999,
"role": "postgrest_test_author",
"id": "jdoe",
"aud": null
}|]
auth = authHeaderJWT $ generateJWT jwtPayload
request methodGet "/authors_only" [auth] ""
`shouldRespondWith` 200
context "when the audience claim is not present" $ do
it "succeeds with a JWT with no audience claim" $ do
let jwtPayload = [json|
{
"exp": 9999999999,
"role": "postgrest_test_author",
"id": "jdoe"
}|]
auth = authHeaderJWT $ generateJWT jwtPayload
request methodGet "/authors_only" [auth] ""
`shouldRespondWith` 200
it "succeeds without a JWT" $
get "/has_count_column" `shouldRespondWith` 200
disabledSpec :: SpecWith ((), Application)
disabledSpec = describe "test handling of aud claims in JWT when the jwt-aud config is not set" $ do
context "when the audience claim is a string" $ do
it "ignores the audience claim and suceeds" $ do
let jwtPayload =
[json|{
"exp": 9999999999,
"role": "postgrest_test_author",
"id": "jdoe",
"aud": "youraudience"
}|]
auth = authHeaderJWT $ generateJWT jwtPayload
request methodGet "/authors_only" [auth] ""
`shouldRespondWith` 200
it "ignores the audience claim and suceeds when it's empty" $ do
let jwtPayload =
[json|{
"exp": 9999999999,
"role": "postgrest_test_author",
"id": "jdoe",
"aud": ""
}|]
auth = authHeaderJWT $ generateJWT jwtPayload
request methodGet "/authors_only" [auth] ""
`shouldRespondWith` 200
context "when the audience is an array of strings" $ do
it "ignores the audience claim and suceeds when it has 1 element" $ do
let jwtPayload = [json|
{
"exp": 9999999999,
"role": "postgrest_test_author",
"id": "jdoe",
"aud": ["youraudience"]
}|]
auth = authHeaderJWT $ generateJWT jwtPayload
request methodGet "/authors_only" [auth] ""
`shouldRespondWith` 200
it "ignores the audience claim and suceeds when it has more than 1 element" $ do
let jwtPayload = [json|
{
"exp": 9999999999,
"role": "postgrest_test_author",
"id": "jdoe",
"aud": ["notyouraudience", "youraudience", "anotheraudience"]
}|]
auth = authHeaderJWT $ generateJWT jwtPayload
request methodGet "/authors_only" [auth] ""
`shouldRespondWith` 200
it "ignores the audience claim and suceeds when it's empty" $ do
let jwtPayload = [json|
{
"exp": 9999999999,
"role": "postgrest_test_author",
"id": "jdoe",
"aud": []
}|]
auth = authHeaderJWT $ generateJWT jwtPayload
request methodGet "/authors_only" [auth] ""
`shouldRespondWith` 200
it "ignores the audience claim and succeeds when it's null" $ do
let jwtPayload = [json|
{
"exp": 9999999999,
"role": "postgrest_test_author",
"id": "jdoe",
"aud": null
}|]
auth = authHeaderJWT $ generateJWT jwtPayload
request methodGet "/authors_only" [auth] ""
`shouldRespondWith` 200
context "when the audience claim is not present" $ do
it "succeeds with a JWT with no audience claim" $ do
let jwtPayload = [json|
{
"exp": 9999999999,
"role": "postgrest_test_author",
"id": "jdoe"
}|]
auth = authHeaderJWT $ generateJWT jwtPayload
request methodGet "/authors_only" [auth] ""
`shouldRespondWith` 200
it "succeeds without a JWT" $
get "/has_count_column" `shouldRespondWith` 200
test/spec/Main.hs
+2 -1
View File
@@ -137,7 +137,8 @@ main = do
analyzeTable "child_entities"
specs = uncurry describe <$> [
("Feature.Auth.AuthSpec" , Feature.Auth.AuthSpec.spec)
("Feature.Auth.AudienceJwtSecretSpec" , Feature.Auth.AudienceJwtSecretSpec.disabledSpec)
, ("Feature.Auth.AuthSpec" , Feature.Auth.AuthSpec.spec)
, ("Feature.ConcurrentSpec" , Feature.ConcurrentSpec.spec)
, ("Feature.CorsSpec" , Feature.CorsSpec.spec)
, ("Feature.CustomMediaSpec" , Feature.Query.CustomMediaSpec.spec)