329 lines
13 KiB
Python
329 lines
13 KiB
Python
|
"""
|
||
|
|
Authentication security tests.
|
||
|
|
|
||
|
|
Control coverage
|
||
|
|
────────────────
|
||
|
|
OWASP ASVS v4.0 V2 Authentication Verification
|
||
|
|
V3 Session Management Verification
|
||
|
|
OWASP API Top 10 API2:2023 Broken Authentication
|
||
|
|
"""
|
||
|
|
import base64
|
||
|
|
import json
|
||
|
|
from datetime import timedelta
|
||
|
|
|
||
|
|
import pytest
|
||
|
|
from httpx import AsyncClient
|
||
|
|
from jose import jwt as jose_jwt
|
||
|
|
from sqlalchemy import update as sa_update
|
||
|
|
|
||
|
|
from app.auth.jwt import create_access_token
|
||
|
|
from app.models.user import User
|
||
|
|
|
||
|
|
pytestmark = pytest.mark.asyncio
|
||
|
|
|
||
|
|
|
||
|
|
# ── V2.1 Password security ───────────────────────────────────────────────────
|
||
|
|
|
||
|
|
class TestCredentialValidation:
|
||
|
|
"""ASVS V2.1 — Credential acceptance and rejection rules."""
|
||
|
|
|
||
|
|
async def test_wrong_password_returns_401(self, client: AsyncClient, admin_user):
|
||
|
|
"""ASVS 2.1.1 | API2 — Incorrect password is rejected with 401."""
|
||
|
|
resp = await client.post(
|
||
|
|
"/api/v1/auth/login",
|
||
|
|
json={"email": "admin@example.com", "password": "wrongpassword"},
|
||
|
|
)
|
||
|
|
assert resp.status_code == 401
|
||
|
|
|
||
|
|
async def test_unknown_email_returns_401(self, client: AsyncClient):
|
||
|
|
"""ASVS 2.1.1 | API2 — Unregistered email returns 401, not 404.
|
||
|
|
|
||
|
|
Returning 404 for an unknown email would allow attackers to enumerate
|
||
|
|
registered accounts.
|
||
|
|
"""
|
||
|
|
resp = await client.post(
|
||
|
|
"/api/v1/auth/login",
|
||
|
|
json={"email": "ghost@example.com", "password": "anything"},
|
||
|
|
)
|
||
|
|
assert resp.status_code == 401
|
||
|
|
|
||
|
|
async def test_empty_password_rejected(self, client: AsyncClient, admin_user):
|
||
|
|
"""ASVS 2.1.1 — Empty password string is rejected."""
|
||
|
|
resp = await client.post(
|
||
|
|
"/api/v1/auth/login",
|
||
|
|
json={"email": "admin@example.com", "password": ""},
|
||
|
|
)
|
||
|
|
assert resp.status_code in (401, 422)
|
||
|
|
|
||
|
|
async def test_null_password_rejected(self, client: AsyncClient, admin_user):
|
||
|
|
"""ASVS 2.1.1 — Null password field fails schema validation."""
|
||
|
|
resp = await client.post(
|
||
|
|
"/api/v1/auth/login",
|
||
|
|
json={"email": "admin@example.com", "password": None},
|
||
|
|
)
|
||
|
|
assert resp.status_code == 422
|
||
|
|
|
||
|
|
async def test_missing_fields_rejected(self, client: AsyncClient):
|
||
|
|
"""ASVS 2.1.1 — Requests missing required auth fields return 422."""
|
||
|
|
resp = await client.post("/api/v1/auth/login", json={})
|
||
|
|
assert resp.status_code == 422
|
||
|
|
|
||
|
|
async def test_very_long_password_handled_safely(self, client: AsyncClient, admin_user):
|
||
|
|
"""ASVS 2.1.7 — Passwords of 1 000+ characters must not cause a 500.
|
||
|
|
|
||
|
|
bcrypt >= 4.0 raises ValueError('Password must be 72 bytes or fewer') when
|
||
|
|
checkpw() is called with an oversized password. The app must catch this and
|
||
|
|
return 401 rather than propagating a 500.
|
||
|
|
"""
|
||
|
|
resp = await client.post(
|
||
|
|
"/api/v1/auth/login",
|
||
|
|
json={"email": "admin@example.com", "password": "x" * 1000},
|
||
|
|
)
|
||
|
|
assert resp.status_code == 401
|
||
|
|
|
||
|
|
async def test_unicode_password_handled_safely(self, client: AsyncClient, admin_user):
|
||
|
|
"""ASVS 2.1.4 — Multi-byte / emoji passwords do not cause a 500."""
|
||
|
|
resp = await client.post(
|
||
|
|
"/api/v1/auth/login",
|
||
|
|
json={"email": "admin@example.com", "password": "пароль🔑emoji"},
|
||
|
|
)
|
||
|
|
assert resp.status_code == 401
|
||
|
|
|
||
|
|
async def test_inactive_account_rejected(
|
||
|
|
self, client: AsyncClient, admin_user, db_session
|
||
|
|
):
|
||
|
|
"""ASVS 2.1.10 — Deactivated accounts cannot authenticate.
|
||
|
|
|
||
|
|
is_active=False is the soft-disable mechanism; the login handler checks
|
||
|
|
this after verifying the password.
|
||
|
|
"""
|
||
|
|
await db_session.execute(
|
||
|
|
sa_update(User)
|
||
|
|
.where(User.id == admin_user.id)
|
||
|
|
.values(is_active=False)
|
||
|
|
)
|
||
|
|
await db_session.commit()
|
||
|
|
|
||
|
|
resp = await client.post(
|
||
|
|
"/api/v1/auth/login",
|
||
|
|
json={"email": "admin@example.com", "password": "testpassword"},
|
||
|
|
)
|
||
|
|
assert resp.status_code == 401
|
||
|
|
|
||
|
|
async def test_error_response_does_not_enumerate_users(
|
||
|
|
self, client: AsyncClient, admin_user
|
||
|
|
):
|
||
|
|
"""ASVS 2.2.2 | API2 — Bad password and unknown email return identical status codes.
|
||
|
|
|
||
|
|
A differing status code (e.g. 404 vs 401) or error message leaks
|
||
|
|
whether an address is registered, enabling user enumeration.
|
||
|
|
"""
|
||
|
|
wrong_pass = await client.post(
|
||
|
|
"/api/v1/auth/login",
|
||
|
|
json={"email": "admin@example.com", "password": "wrong"},
|
||
|
|
)
|
||
|
|
no_user = await client.post(
|
||
|
|
"/api/v1/auth/login",
|
||
|
|
json={"email": "nobody@example.com", "password": "wrong"},
|
||
|
|
)
|
||
|
|
assert wrong_pass.status_code == no_user.status_code == 401
|
||
|
|
|
||
|
|
|
||
|
|
# ── V3.5 Token-based session management ─────────────────────────────────────
|
||
|
|
|
||
|
|
class TestJWTSecurity:
|
||
|
|
"""ASVS V3.5 | API2 — JWT access token validation controls."""
|
||
|
|
|
||
|
|
async def test_no_auth_header_rejected(self, client: AsyncClient):
|
||
|
|
"""ASVS 3.5.1 | API2 — Write endpoint with no Authorization header is denied."""
|
||
|
|
resp = await client.post(
|
||
|
|
"/api/v1/pages",
|
||
|
|
json={"title": "x", "slug": "x", "body": "x"},
|
||
|
|
)
|
||
|
|
assert resp.status_code in (401, 403)
|
||
|
|
|
||
|
|
async def test_garbage_bearer_token_rejected(self, client: AsyncClient):
|
||
|
|
"""ASVS 3.5.1 | API2 — Arbitrary string in Bearer position is rejected."""
|
||
|
|
resp = await client.post(
|
||
|
|
"/api/v1/pages",
|
||
|
|
json={"title": "x", "slug": "x", "body": "x"},
|
||
|
|
headers={"Authorization": "Bearer not-a-real-jwt"},
|
||
|
|
)
|
||
|
|
assert resp.status_code in (401, 403)
|
||
|
|
|
||
|
|
async def test_wrong_signing_key_rejected(self, client: AsyncClient, admin_user):
|
||
|
|
"""ASVS 3.5.1 | API2 — JWT signed with a different secret is rejected.
|
||
|
|
|
||
|
|
Tokens signed with a different key have a valid structure but fail
|
||
|
|
signature verification against the server's SECRET_KEY.
|
||
|
|
"""
|
||
|
|
fake_token = jose_jwt.encode(
|
||
|
|
{"sub": str(admin_user.id)}, "wrong-secret", algorithm="HS256"
|
||
|
|
)
|
||
|
|
resp = await client.post(
|
||
|
|
"/api/v1/pages",
|
||
|
|
json={"title": "x", "slug": "x", "body": "x"},
|
||
|
|
headers={"Authorization": f"Bearer {fake_token}"},
|
||
|
|
)
|
||
|
|
assert resp.status_code in (401, 403)
|
||
|
|
|
||
|
|
async def test_expired_access_token_rejected(self, client: AsyncClient, admin_user):
|
||
|
|
"""ASVS 3.5.2 | API2 — Expired JWT is rejected even if the signature is valid.
|
||
|
|
|
||
|
|
An expired token is issued with expires_delta in the past (-1 s), so
|
||
|
|
the 'exp' claim is already exceeded at the time of the request.
|
||
|
|
"""
|
||
|
|
expired = create_access_token(
|
||
|
|
data={"sub": str(admin_user.id)},
|
||
|
|
expires_delta=timedelta(seconds=-1),
|
||
|
|
)
|
||
|
|
resp = await client.post(
|
||
|
|
"/api/v1/pages",
|
||
|
|
json={"title": "x", "slug": "x", "body": "x"},
|
||
|
|
headers={"Authorization": f"Bearer {expired}"},
|
||
|
|
)
|
||
|
|
assert resp.status_code in (401, 403)
|
||
|
|
|
||
|
|
async def test_alg_none_attack_rejected(self, client: AsyncClient, admin_user):
|
||
|
|
"""ASVS 3.5.3 | API2 — JWT with algorithm 'none' (unsigned) is rejected.
|
||
|
|
|
||
|
|
The 'alg: none' attack tricks vulnerable verifiers into accepting
|
||
|
|
unsigned tokens. python-jose rejects them when a key is expected.
|
||
|
|
The unsigned token is constructed manually to avoid library restrictions.
|
||
|
|
"""
|
||
|
|
header_b64 = base64.urlsafe_b64encode(
|
||
|
|
b'{"alg":"none","typ":"JWT"}'
|
||
|
|
).rstrip(b"=").decode()
|
||
|
|
payload_b64 = base64.urlsafe_b64encode(
|
||
|
|
json.dumps({"sub": str(admin_user.id)}).encode()
|
||
|
|
).rstrip(b"=").decode()
|
||
|
|
none_token = f"{header_b64}.{payload_b64}."
|
||
|
|
|
||
|
|
resp = await client.post(
|
||
|
|
"/api/v1/pages",
|
||
|
|
json={"title": "x", "slug": "x", "body": "x"},
|
||
|
|
headers={"Authorization": f"Bearer {none_token}"},
|
||
|
|
)
|
||
|
|
assert resp.status_code in (401, 403)
|
||
|
|
|
||
|
|
async def test_tampered_payload_rejected(self, client: AsyncClient, admin_user):
|
||
|
|
"""ASVS 3.5.1 | API2 — JWT with a replaced payload but original signature is rejected.
|
||
|
|
|
||
|
|
The signature covers the original header+payload. Swapping the payload
|
||
|
|
invalidates the signature, so the token must be rejected even though
|
||
|
|
the signature portion itself is a valid HMAC.
|
||
|
|
"""
|
||
|
|
valid_token = create_access_token(data={"sub": str(admin_user.id)})
|
||
|
|
header, _, signature = valid_token.split(".")
|
||
|
|
|
||
|
|
fake_payload = base64.urlsafe_b64encode(
|
||
|
|
json.dumps({"sub": "00000000-0000-0000-0000-000000000000"}).encode()
|
||
|
|
).rstrip(b"=").decode()
|
||
|
|
tampered = f"{header}.{fake_payload}.{signature}"
|
||
|
|
|
||
|
|
resp = await client.post(
|
||
|
|
"/api/v1/pages",
|
||
|
|
json={"title": "x", "slug": "x", "body": "x"},
|
||
|
|
headers={"Authorization": f"Bearer {tampered}"},
|
||
|
|
)
|
||
|
|
assert resp.status_code in (401, 403)
|
||
|
|
|
||
|
|
async def test_token_in_query_string_rejected(self, client: AsyncClient, admin_user):
|
||
|
|
"""ASVS 3.5.1 | API2 — Bearer token passed as a query parameter is rejected.
|
||
|
|
|
||
|
|
Tokens in URLs appear in server logs, browser history, and Referer
|
||
|
|
headers, making them trivially leakable. Only the Authorization header
|
||
|
|
is accepted.
|
||
|
|
"""
|
||
|
|
valid_token = create_access_token(data={"sub": str(admin_user.id)})
|
||
|
|
resp = await client.post(
|
||
|
|
f"/api/v1/pages?token={valid_token}",
|
||
|
|
json={"title": "x", "slug": "x", "body": "x"},
|
||
|
|
)
|
||
|
|
assert resp.status_code in (401, 403)
|
||
|
|
|
||
|
|
async def test_basic_auth_scheme_rejected(self, client: AsyncClient, admin_user):
|
||
|
|
"""ASVS 3.5.1 | API2 — HTTP Basic Auth scheme is not accepted; Bearer is required."""
|
||
|
|
import base64 as b64
|
||
|
|
credentials = b64.b64encode(b"admin@example.com:testpassword").decode()
|
||
|
|
resp = await client.post(
|
||
|
|
"/api/v1/pages",
|
||
|
|
json={"title": "x", "slug": "x", "body": "x"},
|
||
|
|
headers={"Authorization": f"Basic {credentials}"},
|
||
|
|
)
|
||
|
|
assert resp.status_code in (401, 403)
|
||
|
|
|
||
|
|
|
||
|
|
# ── V3.5 Refresh token rotation and revocation ───────────────────────────────
|
||
|
|
|
||
|
|
class TestRefreshTokenSecurity:
|
||
|
|
"""ASVS V3.5 | API2 — Refresh token single-use rotation and revocation."""
|
||
|
|
|
||
|
|
async def test_refresh_token_is_rotated_and_old_token_revoked(
|
||
|
|
self, client: AsyncClient, admin_user
|
||
|
|
):
|
||
|
|
"""ASVS 3.5.2 — After rotation the original refresh token cannot be reused.
|
||
|
|
|
||
|
|
The server performs one-time-use rotation: on each /auth/refresh call the
|
||
|
|
presented token is revoked atomically and a new pair is issued. Presenting
|
||
|
|
the old token a second time must return 401.
|
||
|
|
"""
|
||
|
|
login = await client.post(
|
||
|
|
"/api/v1/auth/login",
|
||
|
|
json={"email": "admin@example.com", "password": "testpassword"},
|
||
|
|
)
|
||
|
|
assert login.status_code == 200
|
||
|
|
original_refresh = login.json()["refresh_token"]
|
||
|
|
|
||
|
|
rotate = await client.post(
|
||
|
|
"/api/v1/auth/refresh",
|
||
|
|
json={"refresh_token": original_refresh},
|
||
|
|
)
|
||
|
|
assert rotate.status_code == 200
|
||
|
|
assert rotate.json()["refresh_token"] != original_refresh
|
||
|
|
|
||
|
|
reuse = await client.post(
|
||
|
|
"/api/v1/auth/refresh",
|
||
|
|
json={"refresh_token": original_refresh},
|
||
|
|
)
|
||
|
|
assert reuse.status_code == 401
|
||
|
|
|
||
|
|
async def test_forged_refresh_token_rejected(self, client: AsyncClient):
|
||
|
|
"""ASVS 3.5.2 | API2 — A randomly-generated string is not a valid refresh token."""
|
||
|
|
resp = await client.post(
|
||
|
|
"/api/v1/auth/refresh",
|
||
|
|
json={"refresh_token": "totally-made-up-random-value"},
|
||
|
|
)
|
||
|
|
assert resp.status_code == 401
|
||
|
|
|
||
|
|
async def test_empty_refresh_token_rejected(self, client: AsyncClient):
|
||
|
|
"""ASVS 3.5.2 — Empty refresh token string is rejected."""
|
||
|
|
resp = await client.post(
|
||
|
|
"/api/v1/auth/refresh",
|
||
|
|
json={"refresh_token": ""},
|
||
|
|
)
|
||
|
|
assert resp.status_code in (401, 422)
|
||
|
|
|
||
|
|
async def test_new_access_token_is_functional(
|
||
|
|
self, client: AsyncClient, admin_user
|
||
|
|
):
|
||
|
|
"""ASVS 3.5.2 — Access token issued after a refresh is accepted by protected endpoints."""
|
||
|
|
login = await client.post(
|
||
|
|
"/api/v1/auth/login",
|
||
|
|
json={"email": "admin@example.com", "password": "testpassword"},
|
||
|
|
)
|
||
|
|
original_refresh = login.json()["refresh_token"]
|
||
|
|
|
||
|
|
rotate = await client.post(
|
||
|
|
"/api/v1/auth/refresh",
|
||
|
|
json={"refresh_token": original_refresh},
|
||
|
|
)
|
||
|
|
new_access = rotate.json()["access_token"]
|
||
|
|
|
||
|
|
resp = await client.post(
|
||
|
|
"/api/v1/pages",
|
||
|
|
json={"title": "Post-refresh", "slug": "post-refresh", "body": "<p>ok</p>"},
|
||
|
|
headers={"Authorization": f"Bearer {new_access}"},
|
||
|
|
)
|
||
|
|
assert resp.status_code == 201
|