Issue #104: AuthTkt plugin was passing an invalid cookie value in headers ...

Tres Seaver

2009-11-05 798feb1319306c7d7869967e3e19c55ad7b8d516

Issue #104:  AuthTkt plugin was passing an invalid cookie value in
headers from ``forget``, and was not setting the ``Max-Age`` and 
``Expires`` attributes of those cookies.

 CHANGES.txt

@@ -1,6 +1,13 @@
repoze.who Changelog
====================

After 1.0.17
------------

- Issue #104:  AuthTkt plugin was passing an invalid cookie value in
  headers from ``forget``, and was not setting the ``Max-Age`` and 
  ``Expires`` attributes of those cookies.

1.0.17 (2009-11-05)
-------------------


 repoze/who/plugins/auth_tkt.py

@@ -11,6 +11,12 @@

from repoze.who.interfaces import IIdentifier

_NOW_TESTING = None  # unit tests can replace
def _now():  #pragma NO COVERAGE
    if _NOW_TESTING is not None:
        return _NOW_TESTING
    return datetime.datetime.now()

class AuthTktCookiePlugin(object):

    implements(IIdentifier)
@@ -87,8 +93,7 @@

    def _get_cookies(self, environ, value, max_age=None):
        if max_age is not None:
            later = datetime.datetime.now() + datetime.timedelta(
                seconds=int(max_age))
            later = _now() + datetime.timedelta(seconds=int(max_age))
            # Wdy, DD-Mon-YY HH:MM:SS GMT
            expires = later.strftime('%a, %d %b %Y %H:%M:%S')
            # the Expires header is *required* at least for IE7 (IE7 does
@@ -112,7 +117,7 @@
    # IIdentifier
    def forget(self, environ, identity):
        # return a set of expires Set-Cookie headers
        return self._get_cookies(environ, '""')
        return self._get_cookies(environ, 'INVALID', 0)
    
    # IIdentifier
    def remember(self, environ, identity):

 repoze/who/plugins/tests/test_authtkt.py

@@ -2,6 +2,7 @@

class TestAuthTktCookiePlugin(unittest.TestCase):
    tempdir = None
    _now_testing = None

    def setUp(self):
        pass
@@ -10,6 +11,8 @@
        if self.tempdir is not None:
            import shutil
            shutil.rmtree(self.tempdir)
        if self._now_testing is not None:
            self._setNowTesting(self._now_testing)

    def _getTargetClass(self):
        from repoze.who.plugins.auth_tkt import AuthTktCookiePlugin
@@ -42,6 +45,10 @@
            cookie_name=cookie_name,
            secure=secure)
        return ticket.cookie_value()

    def _setNowTesting(self, value):
        from repoze.who.plugins import auth_tkt
        auth_tkt._NOW_TESTING, self._now_testing = value, auth_tkt._NOW_TESTING

    def test_implements(self):
        from zope.interface.verify import verifyClass
@@ -263,7 +270,8 @@
    def test_remember_creds_reissue(self):
        import time
        plugin = self._makeOne('secret', reissue_time=1)
        old_val = self._makeTicket(userid='userid', userdata='', time=time.time()-2)
        old_val = self._makeTicket(userid='userid', userdata='',
                                   time=time.time()-2)
        environ = self._makeEnviron({'HTTP_COOKIE':'auth_tkt=%s' % old_val})
        new_val = self._makeTicket(userid='userid', userdata='')
        result = plugin.remember(environ, {'repoze.who.userid':'userid',
@@ -275,6 +283,9 @@
                          'auth_tkt="%s"; Path=/' % new_val))

    def test_forget(self):
        from datetime import datetime
        now = datetime(2009, 11, 5, 16, 15, 22)
        self._setNowTesting(now)
        plugin = self._makeOne('secret')
        environ = self._makeEnviron()
        headers = plugin.forget(environ, None)
@@ -282,15 +293,24 @@
        header = headers[0]
        name, value = header
        self.assertEqual(name, 'Set-Cookie')
        self.assertEqual(value, 'auth_tkt=""""; Path=/')
        self.assertEqual(value,
                         'auth_tkt="INVALID"; Path=/; '
                         'Max-Age=0; Expires=Thu, 05 Nov 2009 16:15:22'
                         )
        header = headers[1]
        name, value = header
        self.assertEqual(name, 'Set-Cookie')
        self.assertEqual(value, 'auth_tkt=""""; Path=/; Domain=localhost')
        self.assertEqual(value,
                         'auth_tkt="INVALID"; Path=/; Domain=localhost; '
                         'Max-Age=0; Expires=Thu, 05 Nov 2009 16:15:22'
                         )
        header = headers[2]
        name, value = header
        self.assertEqual(name, 'Set-Cookie')
        self.assertEqual(value, 'auth_tkt=""""; Path=/; Domain=.localhost')
        self.assertEqual(value,
                         'auth_tkt="INVALID"; Path=/; Domain=.localhost; '
                         'Max-Age=0; Expires=Thu, 05 Nov 2009 16:15:22'
                        )

    def test_factory_wo_secret_wo_secretfile_raises_ValueError(self):
        from repoze.who.plugins.auth_tkt import make_plugin