1
0
Fork 0
mirror of https://github.com/rails/rails.git synced 2022-11-09 12:12:34 -05:00
rails--rails/actionpack/test/dispatch/session/cookie_store_test.rb

359 lines
10 KiB
Ruby
Raw Normal View History

require 'abstract_unit'
require 'stringio'
2012-10-30 23:06:46 -04:00
require 'active_support/key_generator'
class CookieStoreTest < ActionDispatch::IntegrationTest
2008-12-15 17:33:31 -05:00
SessionKey = '_myapp_session'
SessionSecret = 'b3c631c314c0bbca50c1b2843150fe33'
Generator = ActiveSupport::LegacyKeyGenerator.new(SessionSecret)
Verifier = ActiveSupport::MessageVerifier.new(SessionSecret, :digest => 'SHA1')
SignedBar = Verifier.generate(:foo => "bar", :session_id => SecureRandom.hex(16))
2008-12-15 17:33:31 -05:00
class TestController < ActionController::Base
def no_session_access
head :ok
end
def persistent_session_id
render :text => session[:session_id]
end
2008-12-15 17:33:31 -05:00
def set_session_value
session[:foo] = "bar"
render :text => Rack::Utils.escape(Verifier.generate(session.to_hash))
end
2008-12-15 17:33:31 -05:00
def get_session_value
render :text => "foo: #{session[:foo].inspect}"
end
def get_session_id
render :text => "id: #{request.session.id}"
end
def get_class_after_reset_session
reset_session
render :text => "class: #{session.class}"
end
def call_session_clear
session.clear
head :ok
end
def call_reset_session
reset_session
head :ok
end
2008-12-15 17:33:31 -05:00
def raise_data_overflow
session[:foo] = 'bye!' * 1024
head :ok
end
def change_session_id
request.session.options[:id] = nil
get_session_id
end
2011-05-04 14:12:27 -04:00
def renew_session_id
request.session_options[:renew] = true
head :ok
end
end
2008-12-15 17:33:31 -05:00
def test_setting_session_value
with_test_route_set do
get '/set_session_value'
assert_response :success
assert_equal "_myapp_session=#{response.body}; path=/; HttpOnly",
2008-12-15 17:33:31 -05:00
headers['Set-Cookie']
end
end
2008-12-15 17:33:31 -05:00
def test_getting_session_value
with_test_route_set do
cookies[SessionKey] = SignedBar
get '/get_session_value'
assert_response :success
assert_equal 'foo: "bar"', response.body
end
end
def test_getting_session_id
with_test_route_set do
cookies[SessionKey] = SignedBar
get '/persistent_session_id'
assert_response :success
2014-08-18 02:29:21 -04:00
assert_equal 32, response.body.size
session_id = response.body
get '/get_session_id'
assert_response :success
assert_equal "id: #{session_id}", response.body, "should be able to read session id without accessing the session hash"
end
end
2008-12-15 17:33:31 -05:00
def test_disregards_tampered_sessions
with_test_route_set do
cookies[SessionKey] = "BAh7BjoIZm9vIghiYXI%3D--123456780"
get '/get_session_value'
assert_response :success
assert_equal 'foo: nil', response.body
end
end
2010-09-13 17:29:25 -04:00
def test_does_not_set_secure_cookies_over_http
with_test_route_set(:secure => true) do
get '/set_session_value'
assert_response :success
assert_equal nil, headers['Set-Cookie']
end
end
2011-05-04 14:12:27 -04:00
def test_properly_renew_cookies
with_test_route_set do
get '/set_session_value'
get '/persistent_session_id'
session_id = response.body
get '/renew_session_id'
get '/persistent_session_id'
assert_not_equal response.body, session_id
end
end
2010-09-13 17:29:25 -04:00
def test_does_set_secure_cookies_over_https
with_test_route_set(:secure => true) do
get '/set_session_value', headers: { 'HTTPS' => 'on' }
2010-09-13 17:29:25 -04:00
assert_response :success
assert_equal "_myapp_session=#{response.body}; path=/; secure; HttpOnly",
headers['Set-Cookie']
end
end
# {:foo=>#<SessionAutoloadTest::Foo bar:"baz">, :session_id=>"ce8b0752a6ab7c7af3cdb8a80e6b9e46"}
SignedSerializedCookie = "BAh7BzoIZm9vbzodU2Vzc2lvbkF1dG9sb2FkVGVzdDo6Rm9vBjoJQGJhciIIYmF6Og9zZXNzaW9uX2lkIiVjZThiMDc1MmE2YWI3YzdhZjNjZGI4YTgwZTZiOWU0Ng==--2bf3af1ae8bd4e52b9ac2099258ace0c380e601c"
def test_deserializes_unloaded_classes_on_get_id
with_test_route_set do
with_autoload_path "session_autoload_test" do
cookies[SessionKey] = SignedSerializedCookie
get '/get_session_id'
assert_response :success
assert_equal 'id: ce8b0752a6ab7c7af3cdb8a80e6b9e46', response.body, "should auto-load unloaded class"
end
end
end
def test_deserializes_unloaded_classes_on_get_value
with_test_route_set do
with_autoload_path "session_autoload_test" do
cookies[SessionKey] = SignedSerializedCookie
get '/get_session_value'
assert_response :success
assert_equal 'foo: #<SessionAutoloadTest::Foo bar:"baz">', response.body, "should auto-load unloaded class"
end
end
end
def test_close_raises_when_data_overflows
2008-12-15 17:33:31 -05:00
with_test_route_set do
assert_raise(ActionDispatch::Cookies::CookieOverflow) {
2008-12-15 17:33:31 -05:00
get '/raise_data_overflow'
}
end
end
2008-12-15 17:33:31 -05:00
def test_doesnt_write_session_cookie_if_session_is_not_accessed
with_test_route_set do
get '/no_session_access'
assert_response :success
2010-01-16 18:21:46 -05:00
assert_equal nil, headers['Set-Cookie']
end
end
2008-12-15 17:33:31 -05:00
def test_doesnt_write_session_cookie_if_session_is_unchanged
with_test_route_set do
cookies[SessionKey] = "BAh7BjoIZm9vIghiYXI%3D--" +
"fef868465920f415f2c0652d6910d3af288a0367"
get '/no_session_access'
assert_response :success
2010-01-16 18:21:46 -05:00
assert_equal nil, headers['Set-Cookie']
end
end
def test_setting_session_value_after_session_reset
with_test_route_set do
get '/set_session_value'
assert_response :success
session_payload = response.body
assert_equal "_myapp_session=#{response.body}; path=/; HttpOnly",
headers['Set-Cookie']
get '/call_reset_session'
assert_response :success
assert_not_equal [], headers['Set-Cookie']
assert_not_nil session_payload
assert_not_equal session_payload, cookies[SessionKey]
get '/get_session_value'
assert_response :success
assert_equal 'foo: nil', response.body
end
end
def test_class_type_after_session_reset
with_test_route_set do
get '/set_session_value'
assert_response :success
assert_equal "_myapp_session=#{response.body}; path=/; HttpOnly",
headers['Set-Cookie']
get '/get_class_after_reset_session'
assert_response :success
assert_not_equal [], headers['Set-Cookie']
assert_equal 'class: ActionDispatch::Request::Session', response.body
end
end
def test_getting_from_nonexistent_session
with_test_route_set do
get '/get_session_value'
assert_response :success
assert_equal 'foo: nil', response.body
assert_nil headers['Set-Cookie'], "should only create session on write, not read"
end
end
def test_setting_session_value_after_session_clear
with_test_route_set do
get '/set_session_value'
assert_response :success
assert_equal "_myapp_session=#{response.body}; path=/; HttpOnly",
headers['Set-Cookie']
get '/call_session_clear'
assert_response :success
get '/get_session_value'
assert_response :success
assert_equal 'foo: nil', response.body
end
end
def test_persistent_session_id
with_test_route_set do
cookies[SessionKey] = SignedBar
get '/persistent_session_id'
assert_response :success
2014-08-18 02:29:21 -04:00
assert_equal 32, response.body.size
session_id = response.body
get '/persistent_session_id'
assert_equal session_id, response.body
reset!
get '/persistent_session_id'
assert_not_equal session_id, response.body
end
end
def test_setting_session_id_to_nil_is_respected
with_test_route_set do
cookies[SessionKey] = SignedBar
get "/get_session_id"
sid = response.body
2014-08-18 02:29:21 -04:00
assert_equal 36, sid.size
get "/change_session_id"
assert_not_equal sid, response.body
end
end
def test_session_store_with_expire_after
with_test_route_set(:expire_after => 5.hours) do
# First request accesses the session
time = Time.local(2008, 4, 24)
Time.stubs(:now).returns(time)
expected_expiry = (time + 5.hours).gmtime.strftime("%a, %d %b %Y %H:%M:%S -0000")
cookies[SessionKey] = SignedBar
get '/set_session_value'
assert_response :success
cookie_body = response.body
Bring abstract_controller up to date with rails/master Resolved all the conflicts since 2.3.0 -> HEAD. Following is a list of commits that could not be applied cleanly or are obviated with the abstract_controller refactor. They all need to be revisited to ensure that fixes made in 2.3 do not reappear in 3.0: 2259ecf368e6a6715966f69216e3ee86bf1a82a7 AR not available * This will be reimplemented with ActionORM or equivalent 06182ea02e92afad579998aa80144588e8865ac3 implicitly rendering a js response should not use the default layout [#1844 state:resolved] * This will be handled generically 893e9eb99504705419ad6edac14d00e71cef5f12 Improve view rendering performance in development mode and reinstate template recompiling in production [#1909 state:resolved] * We will need to reimplement rails-dev-boost on top of the refactor; the changes here are very implementation specific and cannot be cleanly applied. The following commits are implicated: 199e750d46c04970b5e7684998d09405648ecbd4 3942cb406e1d5db0ac00e03153809cc8dc4cc4db f8ea9f85d4f1e3e6f3b5d895bef6b013aa4b0690 e3b166aab37ddc2fbab030b146eb61713b91bf55 ae9f258e03c9fd5088da12c1c6cd216cc89a01f7 44423126c6f6133a1d9cf1d0832b527e8711d40f 0cb020b4d6d838025859bd60fb8151c8e21b8e84 workaround for picking layouts based on wrong view_paths [#1974 state:resolved] * The specifics of this commit no longer apply. Since it is a two-line commit, we will reimplement this change. 8c5cc66a831aadb159f3daaffa4208064c30af0e make action_controller/layouts pick templates from the current instance's view_paths instead of the class view_paths [#1974 state:resolved] * This does not apply at all. It should be trivial to apply the feature to the reimplemented ActionController::Base. 87e8b162463f13bd50d27398f020769460a770e3 fix HTML fallback for explicit templates [#2052 state:resolved] * There were a number of patches related to this that simply compounded each other. Basically none of them apply cleanly, and the underlying issue needs to be revisited. After discussing the underlying problem with Koz, we will defer these fixes for further discussion.
2009-04-13 18:18:45 -04:00
assert_equal "_myapp_session=#{cookie_body}; path=/; expires=#{expected_expiry}; HttpOnly",
headers['Set-Cookie']
# Second request does not access the session
time = Time.local(2008, 4, 25)
Time.stubs(:now).returns(time)
expected_expiry = (time + 5.hours).gmtime.strftime("%a, %d %b %Y %H:%M:%S -0000")
get '/no_session_access'
assert_response :success
assert_equal "_myapp_session=#{cookie_body}; path=/; expires=#{expected_expiry}; HttpOnly",
headers['Set-Cookie']
end
end
def test_session_store_with_explicit_domain
with_test_route_set(:domain => "example.es") do
get '/set_session_value'
assert_match(/domain=example\.es/, headers['Set-Cookie'])
headers['Set-Cookie']
end
end
def test_session_store_without_domain
with_test_route_set do
get '/set_session_value'
assert_no_match(/domain\=/, headers['Set-Cookie'])
end
end
def test_session_store_with_nil_domain
with_test_route_set(:domain => nil) do
get '/set_session_value'
assert_no_match(/domain\=/, headers['Set-Cookie'])
end
end
def test_session_store_with_all_domains
with_test_route_set(:domain => :all) do
get '/set_session_value'
assert_match(/domain=\.example\.com/, headers['Set-Cookie'])
end
end
private
# Overwrite get to send SessionSecret in env hash
def get(path, *args)
args[0] ||= {}
args[0][:headers] ||= {}
args[0][:headers]["action_dispatch.key_generator"] ||= Generator
super(path, *args)
end
def with_test_route_set(options = {})
2008-12-15 17:33:31 -05:00
with_routing do |set|
set.draw do
get ':action', :to => ::CookieStoreTest::TestController
2008-12-15 17:33:31 -05:00
end
options = { :key => SessionKey }.merge!(options)
@app = self.class.build_app(set) do |middleware|
middleware.use ActionDispatch::Session::CookieStore, options
middleware.delete "ActionDispatch::ShowExceptions"
end
2008-12-15 17:33:31 -05:00
yield
end
end
end