Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix: validate authorization schema #167

Merged
merged 2 commits into from
Dec 27, 2023
Merged

fix: validate authorization schema #167

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
f036b04
fix: validate authorization schema
dancastillo Dec 22, 2023
4978a51
fix: test to Bearer per spec and move key after check
dancastillo Dec 26, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 12 additions & 4 deletions lib/verifyBearerAuthFactory.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,9 +25,8 @@ module.exports = function verifyBearerAuthFactory (options) {
}

return function verifyBearerAuth (request, reply, done) {
const header = request.raw.headers.authorization
if (!header) {
const noHeaderError = Error('missing authorization header')
function authorizationHeaderErrorFn (errorMessage) {
const noHeaderError = Error(errorMessage)
if (verifyErrorLogLevel) request.log[verifyErrorLogLevel]('unauthorized: %s', noHeaderError.message)
if (contentType) reply.header('content-type', contentType)
reply.code(401)
Expand All @@ -36,7 +35,16 @@ module.exports = function verifyBearerAuthFactory (options) {
return
}
reply.send(errorResponse(noHeaderError))
return
}

const header = request.raw.headers.authorization
if (!header) {
return authorizationHeaderErrorFn('missing authorization header')
}

const type = header.substring(0, bearerType.length)
dancastillo marked this conversation as resolved.
Show resolved Hide resolved
if (type !== bearerType) {
return authorizationHeaderErrorFn('invalid authorization header')
}

const key = header.substring(bearerType.length).trim()
Expand Down
99 changes: 83 additions & 16 deletions test/verifyBearerAuthFactory.test.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,6 +55,73 @@ test('hook rejects for missing header with custom content type', (t) => {
hook(request, response)
})

test('hook rejects for wrong bearer type but same string length as `bearer`', (t) => {
t.plan(2)

const request = {
log: { error: noop },
raw: { headers: { authorization: `reraeB ${key}` } }
}
const response = {
code: () => response,
send
}

function send (body) {
t.ok(body.error)
t.match(body.error, /invalid authorization header/)
}

const hook = verifyBearerAuthFactory()
hook(request, response)
})

test('hook rejects for wrong bearer type', (t) => {
t.plan(2)

const request = {
log: { error: noop },
raw: { headers: { authorization: `fake-bearer ${key}` } }
}
const response = {
code: () => response,
send
}

function send (body) {
t.ok(body.error)
t.match(body.error, /invalid authorization header/)
}

const hook = verifyBearerAuthFactory()
hook(request, response)
})

test('hook rejects for wrong alternate Bearer', (t) => {
t.plan(2)

const bearerAlt = 'BearerAlt'
const keysAlt = { keys: new Set([key]), bearerType: bearerAlt }
const request = {
log: { error: noop },
raw: {
headers: { authorization: `tlAreraeB ${key}` }
}
}
const response = {
code: () => response,
send
}

function send (body) {
t.ok(body.error)
t.match(body.error, /invalid authorization header/)
}

const hook = verifyBearerAuthFactory(keysAlt)
hook(request, response)
})

test('hook rejects header without bearer prefix', (t) => {
t.plan(2)

Expand Down Expand Up @@ -107,7 +174,7 @@ test('hook accepts correct header', (t) => {
const request = {
log: { error: noop },
raw: {
headers: { authorization: `bearer ${key}` }
headers: { authorization: `Bearer ${key}` }
}
}
const response = {
Expand Down Expand Up @@ -157,7 +224,7 @@ test('hook accepts correct header with extra padding', (t) => {
const request = {
log: { error: noop },
raw: {
headers: { authorization: `bearer ${key} ` }
headers: { authorization: `Bearer ${key} ` }
}
}
const response = {
Expand All @@ -184,7 +251,7 @@ test('hook accepts correct header with auth function (promise)', (t) => {
const request = {
log: { error: noop },
raw: {
headers: { authorization: `bearer ${key}` }
headers: { authorization: `Bearer ${key}` }
}
}
const response = {
Expand All @@ -211,7 +278,7 @@ test('hook accepts correct header with auth function (non-promise)', (t) => {
const request = {
log: { error: noop },
raw: {
headers: { authorization: `bearer ${key}` }
headers: { authorization: `Bearer ${key}` }
}
}
const response = {
Expand All @@ -235,7 +302,7 @@ test('hook rejects wrong token with keys', (t) => {
const request = {
log: { error: noop },
raw: {
headers: { authorization: 'bearer abcdedfg' }
headers: { authorization: 'Bearer abcdedfg' }
}
}
const response = {
Expand All @@ -261,7 +328,7 @@ test('hook rejects wrong token with custom content type', (t) => {
const request = {
log: { error: noop },
raw: {
headers: { authorization: 'bearer abcdefg' }
headers: { authorization: 'Bearer abcdefg' }
}
}
const response = {
Expand Down Expand Up @@ -290,7 +357,7 @@ test('hook rejects wrong token with auth function', (t) => {
const request = {
log: { error: noop },
raw: {
headers: { authorization: 'bearer abcdefg' }
headers: { authorization: 'Bearer abcdefg' }
}
}

Expand Down Expand Up @@ -330,7 +397,7 @@ test('hook rejects wrong token with function (resolved promise)', (t) => {
const request = {
log: { error: noop },
raw: {
headers: { authorization: 'bearer abcdefg' }
headers: { authorization: 'Bearer abcdefg' }
}
}
const response = {
Expand Down Expand Up @@ -363,7 +430,7 @@ test('hook rejects with 500 when functions fails', (t) => {
const request = {
log: { error: noop },
raw: {
headers: { authorization: 'bearer abcdefg' }
headers: { authorization: 'Bearer abcdefg' }
}
}
const response = {
Expand Down Expand Up @@ -396,7 +463,7 @@ test('hook rejects with 500 when promise rejects', (t) => {
const request = {
log: { error: noop },
raw: {
headers: { authorization: 'bearer abcdefg' }
headers: { authorization: 'Bearer abcdefg' }
}
}
const response = {
Expand Down Expand Up @@ -429,7 +496,7 @@ test('hook rejects with 500 when promise rejects with non Error', (t) => {
const request = {
log: { error: noop },
raw: {
headers: { authorization: 'bearer abcdefg' }
headers: { authorization: 'Bearer abcdefg' }
}
}
const response = {
Expand Down Expand Up @@ -457,7 +524,7 @@ test('hook returns proper error for valid key but failing callback', (t) => {
const request = {
log: { error: noop },
raw: {
headers: { authorization: `bearer ${key}` }
headers: { authorization: `Bearer ${key}` }
}
}
const response = {
Expand Down Expand Up @@ -493,7 +560,7 @@ test('hook rejects with 500 when functions returns non-boolean', (t) => {
const request = {
log: { error: noop },
raw: {
headers: { authorization: 'bearer abcdefg' }
headers: { authorization: 'Bearer abcdefg' }
}
}
const response = {
Expand Down Expand Up @@ -526,7 +593,7 @@ test('hook rejects with 500 when promise resolves to non-boolean', (t) => {
const request = {
log: { error: noop },
raw: {
headers: { authorization: 'bearer abcdefg' }
headers: { authorization: 'Bearer abcdefg' }
}
}
const response = {
Expand Down Expand Up @@ -559,7 +626,7 @@ test('hook rejects with 500 when functions returns non-boolean (addHook: false)'
const request = {
log: { error: noop },
raw: {
headers: { authorization: 'bearer abcdefg' }
headers: { authorization: 'Bearer abcdefg' }
}
}
const response = {
Expand Down Expand Up @@ -587,7 +654,7 @@ test('hook rejects with 500 when promise rejects (addHook: false)', (t) => {
const request = {
log: { error: noop },
raw: {
headers: { authorization: 'bearer abcdefg' }
headers: { authorization: 'Bearer abcdefg' }
}
}
const response = {
Expand Down