This is an automated email from the ASF dual-hosted git repository. mark4z pushed a commit to branch 0.4.0 in repository https://gitbox.apache.org/repos/asf/dubbo-go-pixiu.git
commit f6026301182346984067bb79032985774dab3b89 Author: baerwang <[email protected]> AuthorDate: Mon Oct 25 21:35:39 2021 +0800 add:csrf add test get token Former-commit-id: 191dbc71e5a0e96d6be39585eb150157910708d4 --- samples/dubbogo/simple/csrf/server/server.go | 11 ++++ samples/dubbogo/simple/csrf/test/pixiu_test.go | 71 +++++++++++++++++--------- 2 files changed, 57 insertions(+), 25 deletions(-) diff --git a/samples/dubbogo/simple/csrf/server/server.go b/samples/dubbogo/simple/csrf/server/server.go index 6eccca7..7204dba 100644 --- a/samples/dubbogo/simple/csrf/server/server.go +++ b/samples/dubbogo/simple/csrf/server/server.go @@ -18,14 +18,25 @@ package main import ( + "encoding/base64" + "fmt" "log" "net/http" ) func main() { + http.HandleFunc("/login/", func(w http.ResponseWriter, r *http.Request) { + query := r.URL.Query() + _, _ = w.Write([]byte(tokenize(query.Get("secret"), query.Get("key")))) + }) + http.HandleFunc("/user/", func(w http.ResponseWriter, r *http.Request) { _, _ = w.Write([]byte(`{"message":"success","status":200}`)) }) log.Println("Starting sample server ...") log.Fatal(http.ListenAndServe(":1314", nil)) } + +func tokenize(secret, salt string) string { + return base64.URLEncoding.EncodeToString([]byte(fmt.Sprintf("%s-%s", salt, secret))) +} diff --git a/samples/dubbogo/simple/csrf/test/pixiu_test.go b/samples/dubbogo/simple/csrf/test/pixiu_test.go index b57f079..7e97eee 100644 --- a/samples/dubbogo/simple/csrf/test/pixiu_test.go +++ b/samples/dubbogo/simple/csrf/test/pixiu_test.go @@ -29,33 +29,54 @@ import ( "github.com/stretchr/testify/assert" ) +var token string + +func GetToken(t *testing.T) bool { + return t.Run("token", func(t *testing.T) { + urlStr := "http://localhost:1314/login?key=pixiu&secret=pixiu888"; + client := &http.Client{Timeout: 5 * time.Second} + req, err := http.NewRequest("GET", urlStr, nil) + assert.NoError(t, err) + resp, err := client.Do(req) + assert.NoError(t, err) + assert.Equal(t, http.StatusOK, resp.StatusCode) + assert.NotNil(t, resp) + s, _ := ioutil.ReadAll(resp.Body) + token = string(s) + }) +} + func TestCsrfHeader(t *testing.T) { - urlStr := "http://localhost:8888/user/"; - client := &http.Client{Timeout: 5 * time.Second} - req, err := http.NewRequest("GET", urlStr, nil) - assert.NoError(t, err) - req.Header.Set("csrfSalt", "pixiu") - req.Header.Set("pixiu", "cGl4aXUtcGl4aXU4ODg=") - resp, err := client.Do(req) - assert.NoError(t, err) - assert.Equal(t, http.StatusOK, resp.StatusCode) - assert.NotNil(t, resp) - s, _ := ioutil.ReadAll(resp.Body) - t.Log(string(s)) - assert.True(t, strings.Contains(string(s), "success")) + if GetToken(t) && token != "" { + urlStr := "http://localhost:8888/user/"; + client := &http.Client{Timeout: 5 * time.Second} + req, err := http.NewRequest("GET", urlStr, nil) + assert.NoError(t, err) + req.Header.Set("csrfSalt", "pixiu") + req.Header.Set("pixiu", token) + resp, err := client.Do(req) + assert.NoError(t, err) + assert.Equal(t, http.StatusOK, resp.StatusCode) + assert.NotNil(t, resp) + s, _ := ioutil.ReadAll(resp.Body) + t.Log(string(s)) + assert.True(t, strings.Contains(string(s), "success")) + } } func TestCsrfQuery(t *testing.T) { - urlStr := "http://localhost:8888/user?pixiu=cGl4aXUtcGl4aXU4ODg="; - client := &http.Client{Timeout: 5 * time.Second} - req, err := http.NewRequest("GET", urlStr, nil) - assert.NoError(t, err) - req.Header.Set("csrfSalt", "pixiu") - resp, err := client.Do(req) - assert.NoError(t, err) - assert.Equal(t, http.StatusOK, resp.StatusCode) - assert.NotNil(t, resp) - s, _ := ioutil.ReadAll(resp.Body) - t.Log(string(s)) - assert.True(t, strings.Contains(string(s), "success")) + if GetToken(t) && token != "" { + urlStr := "http://localhost:8888/user?pixiu="; + token + client := &http.Client{Timeout: 5 * time.Second} + req, err := http.NewRequest("GET", urlStr, nil) + assert.NoError(t, err) + req.Header.Set("csrfSalt", "pixiu") + resp, err := client.Do(req) + assert.NoError(t, err) + assert.Equal(t, http.StatusOK, resp.StatusCode) + assert.NotNil(t, resp) + s, _ := ioutil.ReadAll(resp.Body) + t.Log(string(s)) + assert.True(t, strings.Contains(string(s), "success")) + } }
