public async Task OnAuthorization_WithDifferentUrl_ShouldNotAuthorize()
{
//Arrange
var cryptoService = new HmacSha256CryptographyService(Options);
TestServer server = TestServerHelper.CreateServer <string>(Options);
var url = "/api/dummy/SomeBewitProtectedUrl";
BewitPayloadContext context = new BewitPayloadContext(typeof(string))
.SetCryptographyService(() => cryptoService)
.SetVariablesProvider(() => TestServerHelper.VariablesProvider)
.SetRepository(() => TestServerHelper.NonceRepository);
var tokenGenerator = new BewitTokenGenerator <string>(Options, context);
BewitToken <string> bewitToken =
await tokenGenerator.GenerateBewitTokenAsync(url.ToLowerInvariant(),
CancellationToken.None);
url = "/api/dummy/WithBewitProtection";
var fullUrl = $"{url}?bewit={bewitToken}";
HttpClient client = server.CreateClient();
//Act
HttpResponseMessage res =
await client.GetAsync(fullUrl, CancellationToken.None);
//Assert
res.StatusCode.Should().Be(HttpStatusCode.Forbidden);
var content = await res.Content.ReadAsStringAsync();
if (content != null)
{
Assert.Equal(-1, content.IndexOf("bar"));
}
}
public async Task OnAuthorization_WithAlteredPayloadForUrl_ShouldNotAuthorize()
{
//Arrange
var cryptoService = new HmacSha256CryptographyService(Options);
TestServer server = TestServerHelper.CreateServer <string>(Options);
var url = "/api/dummy/SomeBewitProtectedUrl";
BewitPayloadContext context = new BewitPayloadContext(typeof(string))
.SetCryptographyService(() => cryptoService)
.SetVariablesProvider(() => TestServerHelper.VariablesProvider)
.SetRepository(() => TestServerHelper.NonceRepository);
var tokenGenerator = new BewitTokenGenerator <string>(Options, context);
BewitToken <string> bewitToken =
await tokenGenerator.GenerateBewitTokenAsync(url.ToLowerInvariant(),
CancellationToken.None);
//try to hack the token by replacing the url but reusing the same hash
url = "/api/dummy/WithBewitProtection";
var serializedBewit =
Encoding.UTF8.GetString(Convert.FromBase64String((string)bewitToken));
Bewit <string> bewitInternal =
JsonConvert.DeserializeObject <Bewit <string> >(serializedBewit);
var newBewitInternal = new Bewit <string>(
bewitInternal.Nonce,
bewitInternal.ExpirationDate,
url.ToLowerInvariant(),
bewitInternal.Hash);
serializedBewit = JsonConvert.SerializeObject(newBewitInternal);
bewitToken = new BewitToken <string>(Convert.ToBase64String(
Encoding.UTF8.GetBytes(serializedBewit)
));
var fullUrl = $"{url}?bewit={bewitToken}";
HttpClient client = server.CreateClient();
//Act
HttpResponseMessage res =
await client.GetAsync(fullUrl, CancellationToken.None);
//Assert
res.StatusCode.Should().Be(HttpStatusCode.Forbidden);
var content = await res.Content.ReadAsStringAsync();
if (content != null)
{
Assert.Equal(-1, content.IndexOf("bar"));
}
}
public async Task SampleGetRequest_NoBewitProtectionOnRoute_ShouldPass()
{
//Arrange
TestServer server = TestServerHelper.CreateServer <string>(Options);
var url = "/api/dummy/NoBewitProtection";
HttpClient client = server.CreateClient();
//Act
HttpResponseMessage res =
await client.GetAsync(url, CancellationToken.None);
//Assert
res.StatusCode.Should().Be(HttpStatusCode.OK);
var content = await res.Content.ReadAsStringAsync();
content.Should().Be("bar");
}
public async Task OnAuthorization_WithValidBewitForUrl_ShouldAuthorize()
{
//Arrange
TestServer server = TestServerHelper.CreateServer <IDictionary <string, object> >(Options);
BewitPayloadContext context = new BewitPayloadContext(typeof(IDictionary <string, object>))
.SetCryptographyService(() => new HmacSha256CryptographyService(Options))
.SetVariablesProvider(() => TestServerHelper.VariablesProvider)
.SetRepository(() => TestServerHelper.NonceRepository);
var tokenGenerator = new BewitTokenGenerator <IDictionary <string, object> >(Options, context);
const string id = "1",
firstName = "John",
lastName = "Smith";
var payload =
new Dictionary <string, object>
{
["firstName"] = "John",
["lastName"] = "Smith"
};
BewitToken <IDictionary <string, object> > bewitToken =
await tokenGenerator.GenerateBewitTokenAsync(
payload,
CancellationToken.None);
var url = $"/api/dummy/WithBewitParameters/{id}";
var fullUrl = $"{url}?bewit={bewitToken}";
HttpClient client = server.CreateClient();
//Act
HttpResponseMessage res =
await client.GetAsync(fullUrl, CancellationToken.None);
//Assert
res.StatusCode.Should().Be(HttpStatusCode.OK);
var content = await res.Content.ReadAsStringAsync();
content.Should().Be($"{id}: {firstName} {lastName}");
}
