go/oauth2-proxy
1
0
Fork 0
mirror of https://github.com/oauth2-proxy/oauth2-proxy.git synced 2025-06-15 00:15:00 +02:00
Code Issues Releases Activity

Stop accepting legacy SHA1 signed cookies

Browse Source
This commit is contained in:
Nick Meves
2020-05-24 11:02:08 -07:00
parent 55a941b76e
commit 56f199a24f
3 changed files with 7 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
pkg/encryption/utils_test.go
View File

@ -94,8 +94,8 @@ func TestSignAndValidate(t *testing.T) {
assert.NoError(t, err)
assert.True(t, checkSignature(sha256sig, seed, key, value, epoch))
// This should be switched to False after fully deprecating SHA1
assert.True(t, checkSignature(sha1sig, seed, key, value, epoch))
// We don't validate legacy SHA1 signatures anymore
assert.False(t, checkSignature(sha1sig, seed, key, value, epoch))
assert.False(t, checkSignature(sha256sig, seed, key, "tampered", epoch))
assert.False(t, checkSignature(sha1sig, seed, key, "tampered", epoch))