public async Task TamperedTimestampMacMustFailClientAuthentication()
{
using (var invoker = new HttpMessageInvoker(server))
{
using (var request = new HttpRequestMessage(HttpMethod.Get, URI))
{
var client = new HawkClient(() => ServerFactory.DefaultCredential);
await client.CreateClientAuthorizationInternalAsync(request, DateTime.UtcNow.AddMinutes(-2));
using (var response = await invoker.SendAsync(request, CancellationToken.None))
{
Assert.AreEqual(HttpStatusCode.Unauthorized, response.StatusCode);
var wwwheader = response.Headers.WwwAuthenticate.FirstOrDefault();
Assert.IsNotNull(wwwheader);
Assert.AreEqual("hawk", wwwheader.Scheme);
Assert.IsNotNull(wwwheader.Parameter);
string tsParameter = wwwheader.Parameter;
// ts and tsm must be present
Assert.IsTrue(ParameterChecker.IsFieldPresent(tsParameter, "ts"));
Assert.IsTrue(ParameterChecker.IsFieldPresent(tsParameter, "tsm"));
Assert.IsTrue(await client.AuthenticateAsync(response));
string tamperedtsParameter = tsParameter.Replace("tsm=\"", "tsm=\"1234"); // tsm="abc" => tsm = "1234abc"
response.Headers.WwwAuthenticate.Remove(wwwheader);
response.Headers.WwwAuthenticate.Add(new AuthenticationHeaderValue("hawk", tamperedtsParameter));
Assert.IsFalse(await client.AuthenticateAsync(response));
}
}
}
}
public async Task MustReturn401WhenHawkParameterTimestampIsStale()
{
using (var invoker = new HttpMessageInvoker(server))
{
using (var request = new HttpRequestMessage(HttpMethod.Get, URI))
{
var client = new HawkClient(() => ServerFactory.DefaultCredential);
await client.CreateClientAuthorizationInternalAsync(request, DateTime.UtcNow.AddMinutes(-2));
using (var response = await invoker.SendAsync(request, CancellationToken.None))
{
Assert.AreEqual(HttpStatusCode.Unauthorized, response.StatusCode);
Assert.IsNotNull(response.Headers.WwwAuthenticate.FirstOrDefault());
Assert.AreEqual("hawk", response.Headers.WwwAuthenticate.FirstOrDefault().Scheme);
Assert.IsFalse(String.IsNullOrEmpty(response.Headers.WwwAuthenticate.FirstOrDefault().Parameter));
string tsParameter = response.Headers.WwwAuthenticate.FirstOrDefault().Parameter;
// ts and tsm must be present
Assert.IsTrue(ParameterChecker.IsFieldPresent(tsParameter, "ts"));
Assert.IsTrue(ParameterChecker.IsFieldPresent(tsParameter, "tsm"));
Assert.IsTrue(await client.AuthenticateAsync(response));
}
}
}
}
