Exemple #1
0
        public async Task OnAuthorization_WithDifferentUrl_ShouldNotAuthorize()
        {
            //Arrange
            var                 cryptoService = new HmacSha256CryptographyService(Options);
            TestServer          server        = TestServerHelper.CreateServer <string>(Options);
            var                 url           = "/api/dummy/SomeBewitProtectedUrl";
            BewitPayloadContext context       = new BewitPayloadContext(typeof(string))
                                                .SetCryptographyService(() => cryptoService)
                                                .SetVariablesProvider(() => TestServerHelper.VariablesProvider)
                                                .SetRepository(() => TestServerHelper.NonceRepository);
            var tokenGenerator             = new BewitTokenGenerator <string>(Options, context);
            BewitToken <string> bewitToken =
                await tokenGenerator.GenerateBewitTokenAsync(url.ToLowerInvariant(),
                                                             CancellationToken.None);

            url = "/api/dummy/WithBewitProtection";
            var        fullUrl = $"{url}?bewit={bewitToken}";
            HttpClient client  = server.CreateClient();

            //Act
            HttpResponseMessage res =
                await client.GetAsync(fullUrl, CancellationToken.None);

            //Assert
            res.StatusCode.Should().Be(HttpStatusCode.Forbidden);
            var content = await res.Content.ReadAsStringAsync();

            if (content != null)
            {
                Assert.Equal(-1, content.IndexOf("bar"));
            }
        }
Exemple #2
0
        public async Task OnAuthorization_WithAlteredPayloadForUrl_ShouldNotAuthorize()
        {
            //Arrange
            var                 cryptoService = new HmacSha256CryptographyService(Options);
            TestServer          server        = TestServerHelper.CreateServer <string>(Options);
            var                 url           = "/api/dummy/SomeBewitProtectedUrl";
            BewitPayloadContext context       = new BewitPayloadContext(typeof(string))
                                                .SetCryptographyService(() => cryptoService)
                                                .SetVariablesProvider(() => TestServerHelper.VariablesProvider)
                                                .SetRepository(() => TestServerHelper.NonceRepository);
            var tokenGenerator             = new BewitTokenGenerator <string>(Options, context);
            BewitToken <string> bewitToken =
                await tokenGenerator.GenerateBewitTokenAsync(url.ToLowerInvariant(),
                                                             CancellationToken.None);

            //try to hack the token by replacing the url but reusing the same hash
            url = "/api/dummy/WithBewitProtection";
            var serializedBewit =
                Encoding.UTF8.GetString(Convert.FromBase64String((string)bewitToken));
            Bewit <string> bewitInternal =
                JsonConvert.DeserializeObject <Bewit <string> >(serializedBewit);
            var newBewitInternal = new Bewit <string>(
                bewitInternal.Nonce,
                bewitInternal.ExpirationDate,
                url.ToLowerInvariant(),
                bewitInternal.Hash);

            serializedBewit = JsonConvert.SerializeObject(newBewitInternal);
            bewitToken      = new BewitToken <string>(Convert.ToBase64String(
                                                          Encoding.UTF8.GetBytes(serializedBewit)
                                                          ));

            var        fullUrl = $"{url}?bewit={bewitToken}";
            HttpClient client  = server.CreateClient();

            //Act
            HttpResponseMessage res =
                await client.GetAsync(fullUrl, CancellationToken.None);

            //Assert
            res.StatusCode.Should().Be(HttpStatusCode.Forbidden);
            var content = await res.Content.ReadAsStringAsync();

            if (content != null)
            {
                Assert.Equal(-1, content.IndexOf("bar"));
            }
        }
Exemple #3
0
        public async Task SampleGetRequest_NoBewitProtectionOnRoute_ShouldPass()
        {
            //Arrange
            TestServer server = TestServerHelper.CreateServer <string>(Options);
            var        url    = "/api/dummy/NoBewitProtection";
            HttpClient client = server.CreateClient();

            //Act
            HttpResponseMessage res =
                await client.GetAsync(url, CancellationToken.None);

            //Assert
            res.StatusCode.Should().Be(HttpStatusCode.OK);
            var content = await res.Content.ReadAsStringAsync();

            content.Should().Be("bar");
        }
        public async Task OnAuthorization_WithValidBewitForUrl_ShouldAuthorize()
        {
            //Arrange
            TestServer          server  = TestServerHelper.CreateServer <IDictionary <string, object> >(Options);
            BewitPayloadContext context = new BewitPayloadContext(typeof(IDictionary <string, object>))
                                          .SetCryptographyService(() => new HmacSha256CryptographyService(Options))
                                          .SetVariablesProvider(() => TestServerHelper.VariablesProvider)
                                          .SetRepository(() => TestServerHelper.NonceRepository);
            var          tokenGenerator = new BewitTokenGenerator <IDictionary <string, object> >(Options, context);
            const string id             = "1",
                         firstName      = "John",
                         lastName       = "Smith";
            var payload =
                new Dictionary <string, object>
            {
                ["firstName"] = "John",
                ["lastName"]  = "Smith"
            };
            BewitToken <IDictionary <string, object> > bewitToken =
                await tokenGenerator.GenerateBewitTokenAsync(
                    payload,
                    CancellationToken.None);

            var        url     = $"/api/dummy/WithBewitParameters/{id}";
            var        fullUrl = $"{url}?bewit={bewitToken}";
            HttpClient client  = server.CreateClient();

            //Act
            HttpResponseMessage res =
                await client.GetAsync(fullUrl, CancellationToken.None);

            //Assert
            res.StatusCode.Should().Be(HttpStatusCode.OK);
            var content = await res.Content.ReadAsStringAsync();

            content.Should().Be($"{id}: {firstName} {lastName}");
        }