public void Should_return_token_mismatch_if_random_bytes_empty()
{
DateTime date = DateTime.Now;
var tokenOne = new CsrfToken {
CreatedDate = date, RandomBytes = ArrayCache.Empty <byte>()
};
var tokenTwo = new CsrfToken {
CreatedDate = date, RandomBytes = ArrayCache.Empty <byte>()
};
tokenOne.CreateHmac(this.hmacProvider);
tokenTwo.CreateHmac(this.hmacProvider);
var result = this.validator.Validate(tokenOne, tokenTwo);
result.ShouldEqual(CsrfTokenValidationResult.TokenTamperedWith);
}
public void Should_return_token_mismatch_if_tokens_differ()
{
DateTime date = DateTime.Now;
var tokenOne = new CsrfToken {
CreatedDate = date, RandomBytes = new byte[] { 1, 2, 3 }
};
var tokenTwo = new CsrfToken {
CreatedDate = date, RandomBytes = new byte[] { 1, 4, 3 }
};
tokenOne.CreateHmac(this.hmacProvider);
tokenTwo.CreateHmac(this.hmacProvider);
var result = this.validator.Validate(tokenOne, tokenTwo);
result.ShouldEqual(CsrfTokenValidationResult.TokenMismatch);
}
public void Should_return_token_ok_if_tokens_match_and_no_expiry_set()
{
DateTime date = DateTime.Now;
var tokenOne = new CsrfToken {
CreatedDate = date, RandomBytes = new byte[] { 1, 2, 3 }
};
var tokenTwo = new CsrfToken {
CreatedDate = date, RandomBytes = new byte[] { 1, 2, 3 }
};
tokenOne.CreateHmac(this.hmacProvider);
tokenTwo.CreateHmac(this.hmacProvider);
var result = this.validator.Validate(tokenOne, tokenTwo);
result.ShouldEqual(CsrfTokenValidationResult.Ok);
}
public void Should_return_ok_if_valid_and_not_expired()
{
DateTime date = DateTime.Now.AddHours(-1);
var tokenOne = new CsrfToken {
CreatedDate = date, RandomBytes = new byte[] { 1, 2, 3 }
};
var tokenTwo = new CsrfToken {
CreatedDate = date, RandomBytes = new byte[] { 1, 2, 3 }
};
tokenOne.CreateHmac(this.hmacProvider);
tokenTwo.CreateHmac(this.hmacProvider);
var result = this.validator.Validate(tokenOne, tokenTwo, validityPeriod: new TimeSpan(1, 30, 0));
result.ShouldEqual(CsrfTokenValidationResult.Ok);
}
public void Should_return_token_tampered_with_if_hmac_incorrect()
{
DateTime date = DateTime.Now;
var tokenOne = new CsrfToken {
CreatedDate = date, RandomBytes = new byte[] { 1, 2, 3 }
};
var tokenTwo = new CsrfToken {
CreatedDate = date, RandomBytes = new byte[] { 1, 2, 3 }
};
tokenOne.CreateHmac(this.hmacProvider);
tokenTwo.CreateHmac(this.hmacProvider);
tokenOne.Hmac[0] -= 1;
tokenTwo.Hmac[0] -= 1;
var result = this.validator.Validate(tokenOne, tokenTwo);
result.ShouldEqual(CsrfTokenValidationResult.TokenTamperedWith);
}