public void GenerateFormToken_AuthenticatedWithoutUsernameAndNoAdditionalData_NoAdditionalData() { // Arrange var cookieToken = new AntiForgeryToken() { IsSessionToken = true }; var httpContext = new Mock <HttpContext>().Object; ClaimsIdentity identity = new MyAuthenticatedIdentityWithoutUsername(); var config = new AntiForgeryOptions(); IClaimUidExtractor claimUidExtractor = new Mock <IClaimUidExtractor>().Object; var tokenProvider = new TokenProvider( config: config, claimUidExtractor: claimUidExtractor, additionalDataProvider: null); // Act & assert var ex = Assert.Throws <InvalidOperationException>( () => tokenProvider.GenerateFormToken(httpContext, identity, cookieToken)); Assert.Equal( "The provided identity of type " + "'Microsoft.AspNet.Mvc.Core.Test.TokenProviderTest+MyAuthenticatedIdentityWithoutUsername' " + "is marked IsAuthenticated = true but does not have a value for Name. " + "By default, the anti-forgery system requires that all authenticated identities have a unique Name. " + "If it is not possible to provide a unique Name for this identity, " + "consider extending IAdditionalDataProvider by overriding the DefaultAdditionalDataProvider " + "or a custom type that can provide some form of unique identifier for the current user.", ex.Message); }
public void GenerateFormToken_AuthenticatedWithoutUsername_WithAdditionalData() { // Arrange var cookieToken = new AntiForgeryToken() { IsSessionToken = true }; var httpContext = new Mock <HttpContext>().Object; ClaimsIdentity identity = new MyAuthenticatedIdentityWithoutUsername(); var mockAdditionalDataProvider = new Mock <IAntiForgeryAdditionalDataProvider>(); mockAdditionalDataProvider.Setup(o => o.GetAdditionalData(httpContext)) .Returns("additional-data"); var config = new AntiForgeryOptions(); IClaimUidExtractor claimUidExtractor = new Mock <IClaimUidExtractor>().Object; var tokenProvider = new TokenProvider( config: config, claimUidExtractor: claimUidExtractor, additionalDataProvider: mockAdditionalDataProvider.Object); // Act var fieldToken = tokenProvider.GenerateFormToken(httpContext, identity, cookieToken); // Assert Assert.NotNull(fieldToken); Assert.Equal(cookieToken.SecurityToken, fieldToken.SecurityToken); Assert.False(fieldToken.IsSessionToken); Assert.Equal("", fieldToken.Username); Assert.Equal(null, fieldToken.ClaimUid); Assert.Equal("additional-data", fieldToken.AdditionalData); }
public void GenerateFormToken_AnonymousUser() { // Arrange var cookieToken = new AntiForgeryToken() { IsSessionToken = true }; var httpContext = new Mock <HttpContext>().Object; var mockIdentity = new Mock <ClaimsIdentity>(); mockIdentity.Setup(o => o.IsAuthenticated) .Returns(false); var config = new AntiForgeryOptions(); var tokenProvider = new TokenProvider( config: config, claimUidExtractor: null, additionalDataProvider: null); // Act var fieldToken = tokenProvider.GenerateFormToken(httpContext, mockIdentity.Object, cookieToken); // Assert Assert.NotNull(fieldToken); Assert.Equal(cookieToken.SecurityToken, fieldToken.SecurityToken); Assert.False(fieldToken.IsSessionToken); Assert.Equal("", fieldToken.Username); Assert.Equal(null, fieldToken.ClaimUid); Assert.Equal("", fieldToken.AdditionalData); }
public void GenerateFormToken_AuthenticatedWithoutUsernameAndNoAdditionalData_NoAdditionalData() { // Arrange var cookieToken = new AntiForgeryToken() { IsSessionToken = true }; var httpContext = new Mock<HttpContext>().Object; ClaimsIdentity identity = new MyAuthenticatedIdentityWithoutUsername(); var config = new AntiForgeryOptions(); IClaimUidExtractor claimUidExtractor = new Mock<IClaimUidExtractor>().Object; var tokenProvider = new TokenProvider( config: config, claimUidExtractor: claimUidExtractor, additionalDataProvider: null); // Act & assert var ex = Assert.Throws<InvalidOperationException>( () => tokenProvider.GenerateFormToken(httpContext, identity, cookieToken)); Assert.Equal( "The provided identity of type " + "'Microsoft.AspNet.Mvc.Core.Test.TokenProviderTest+MyAuthenticatedIdentityWithoutUsername' " + "is marked IsAuthenticated = true but does not have a value for Name. " + "By default, the anti-forgery system requires that all authenticated identities have a unique Name. " + "If it is not possible to provide a unique Name for this identity, " + "consider extending IAdditionalDataProvider by overriding the DefaultAdditionalDataProvider " + "or a custom type that can provide some form of unique identifier for the current user.", ex.Message); }
public void GenerateFormToken_AnonymousUser() { // Arrange var cookieToken = new AntiForgeryToken() { IsSessionToken = true }; var httpContext = new Mock<HttpContext>().Object; var mockIdentity = new Mock<ClaimsIdentity>(); mockIdentity.Setup(o => o.IsAuthenticated) .Returns(false); var config = new AntiForgeryOptions(); var tokenProvider = new TokenProvider( config: config, claimUidExtractor: null, additionalDataProvider: null); // Act var fieldToken = tokenProvider.GenerateFormToken(httpContext, mockIdentity.Object, cookieToken); // Assert Assert.NotNull(fieldToken); Assert.Equal(cookieToken.SecurityToken, fieldToken.SecurityToken); Assert.False(fieldToken.IsSessionToken); Assert.Empty(fieldToken.Username); Assert.Null(fieldToken.ClaimUid); Assert.Empty(fieldToken.AdditionalData); }
public void GenerateFormToken_ClaimsBasedIdentity() { // Arrange var cookieToken = new AntiForgeryToken() { IsSessionToken = true }; var httpContext = new Mock <HttpContext>().Object; var identity = GetAuthenticatedIdentity("some-identity"); var config = new AntiForgeryOptions(); byte[] data = new byte[256 / 8]; using (var rng = RandomNumberGenerator.Create()) { rng.GetBytes(data); } var base64ClaimUId = Convert.ToBase64String(data); var expectedClaimUid = new BinaryBlob(256, data); var mockClaimUidExtractor = new Mock <IClaimUidExtractor>(); mockClaimUidExtractor.Setup(o => o.ExtractClaimUid(identity)) .Returns(base64ClaimUId); var tokenProvider = new TokenProvider( config: config, claimUidExtractor: mockClaimUidExtractor.Object, additionalDataProvider: null); // Act var fieldToken = tokenProvider.GenerateFormToken(httpContext, identity, cookieToken); // Assert Assert.NotNull(fieldToken); Assert.Equal(cookieToken.SecurityToken, fieldToken.SecurityToken); Assert.False(fieldToken.IsSessionToken); Assert.Equal("", fieldToken.Username); Assert.Equal(expectedClaimUid, fieldToken.ClaimUid); Assert.Equal("", fieldToken.AdditionalData); }
public void GenerateFormToken_AuthenticatedWithoutUsername_WithAdditionalData() { // Arrange var cookieToken = new AntiForgeryToken() { IsSessionToken = true }; var httpContext = new Mock<HttpContext>().Object; ClaimsIdentity identity = new MyAuthenticatedIdentityWithoutUsername(); var mockAdditionalDataProvider = new Mock<IAntiForgeryAdditionalDataProvider>(); mockAdditionalDataProvider.Setup(o => o.GetAdditionalData(httpContext)) .Returns("additional-data"); var config = new AntiForgeryOptions(); IClaimUidExtractor claimUidExtractor = new Mock<IClaimUidExtractor>().Object; var tokenProvider = new TokenProvider( config: config, claimUidExtractor: claimUidExtractor, additionalDataProvider: mockAdditionalDataProvider.Object); // Act var fieldToken = tokenProvider.GenerateFormToken(httpContext, identity, cookieToken); // Assert Assert.NotNull(fieldToken); Assert.Equal(cookieToken.SecurityToken, fieldToken.SecurityToken); Assert.False(fieldToken.IsSessionToken); Assert.Empty(fieldToken.Username); Assert.Null(fieldToken.ClaimUid); Assert.Equal("additional-data", fieldToken.AdditionalData); }
public void GenerateFormToken_ClaimsBasedIdentity() { // Arrange var cookieToken = new AntiForgeryToken() { IsSessionToken = true }; var httpContext = new Mock<HttpContext>().Object; var identity = GetAuthenticatedIdentity("some-identity"); var config = new AntiForgeryOptions(); byte[] data = new byte[256 / 8]; using (var rng = RandomNumberGenerator.Create()) { rng.GetBytes(data); } var base64ClaimUId = Convert.ToBase64String(data); var expectedClaimUid = new BinaryBlob(256, data); var mockClaimUidExtractor = new Mock<IClaimUidExtractor>(); mockClaimUidExtractor.Setup(o => o.ExtractClaimUid(identity)) .Returns(base64ClaimUId); var tokenProvider = new TokenProvider( config: config, claimUidExtractor: mockClaimUidExtractor.Object, additionalDataProvider: null); // Act var fieldToken = tokenProvider.GenerateFormToken(httpContext, identity, cookieToken); // Assert Assert.NotNull(fieldToken); Assert.Equal(cookieToken.SecurityToken, fieldToken.SecurityToken); Assert.False(fieldToken.IsSessionToken); Assert.Equal("", fieldToken.Username); Assert.Equal(expectedClaimUid, fieldToken.ClaimUid); Assert.Equal("", fieldToken.AdditionalData); }