Skip to content

Commit 7163012

Browse files
SebastienRichertSebastienRichert
authored
test: Restrain sending http credentials on a specific origin (for roll 1.33 driver) (#1253)
* test: Restrain sending http credentials on a specific origin (for driver 1.33 roll) Verify that the httpCredentials are not sent when origin mismatch (scheme or hostname or port). See microsoft/playwright#20374 * test: Restrain sending http credentials on a specific origin Verify that the httpCredentials are not sent when origin mismatch (scheme or hostname or port). See microsoft/playwright#20374
1 parent be59662 commit 7163012

File tree

4 files changed

+203
-0
lines changed

4 files changed

+203
-0
lines changed

‎playwright/src/test/java/com/microsoft/playwright/TestBrowserContextCredentials.java‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@
1616

1717
package com.microsoft.playwright;
1818

19+
import com.microsoft.playwright.options.HttpCredentials;
1920
import org.junit.jupiter.api.Test;
2021
import org.junit.jupiter.api.condition.DisabledIf;
2122

@@ -74,4 +75,66 @@ void shouldReturnResourceBody() {
7475
assertTrue(new String(response.body()).contains("Playground"));
7576
}
7677
}
78+
79+
@Test
80+
void shouldWorkWithCorrectCredentialsAndMatchingOrigin() {
81+
server.setAuth("/empty.html", "user", "pass");
82+
final HttpCredentials httpCredentials = new HttpCredentials("user", "pass");
83+
httpCredentials.setOrigin(server.PREFIX);
84+
try (BrowserContext context = browser.newContext(new Browser.NewContextOptions()
85+
.setHttpCredentials(httpCredentials))) {
86+
Page page = context.newPage();
87+
Response response = page.navigate(server.EMPTY_PAGE);
88+
assertEquals(200, response.status());
89+
}
90+
}
91+
92+
@Test
93+
void shouldWorkWithCorrectCredentialsAndMatchingOriginCaseInsensitive() {
94+
server.setAuth("/empty.html", "user", "pass");
95+
final HttpCredentials httpCredentials = new HttpCredentials("user", "pass");
96+
httpCredentials.setOrigin(server.PREFIX.toUpperCase());
97+
try (BrowserContext context = browser.newContext(new Browser.NewContextOptions()
98+
.setHttpCredentials(httpCredentials))) {
99+
Page page = context.newPage();
100+
Response response = page.navigate(server.EMPTY_PAGE);
101+
assertEquals(200, response.status());
102+
}
103+
}
104+
105+
@Test
106+
void shouldFailWithCorrectCredentialsAndWrongOriginScheme() {
107+
server.setAuth("/empty.html", "user", "pass");
108+
final HttpCredentials httpCredentials = new HttpCredentials("user", "pass");
109+
httpCredentials.setOrigin(Utils.generateDifferentOriginScheme(server));
110+
try (BrowserContext context = browser.newContext(new Browser.NewContextOptions().setHttpCredentials(httpCredentials))) {
111+
Page page = context.newPage();
112+
Response response = page.navigate(server.EMPTY_PAGE);
113+
assertEquals(401, response.status());
114+
}
115+
}
116+
117+
@Test
118+
void shouldFailWithCorrectCredentialsAndWrongOriginHostname() {
119+
server.setAuth("/empty.html", "user", "pass");
120+
final HttpCredentials httpCredentials = new HttpCredentials("user", "pass");
121+
httpCredentials.setOrigin(Utils.generateDifferentOriginHostname(server));
122+
try (BrowserContext context = browser.newContext(new Browser.NewContextOptions().setHttpCredentials(httpCredentials))) {
123+
Page page = context.newPage();
124+
Response response = page.navigate(server.EMPTY_PAGE);
125+
assertEquals(401, response.status());
126+
}
127+
}
128+
129+
@Test
130+
void shouldFailWithCorrectCredentialsAndWrongOriginPort() {
131+
server.setAuth("/empty.html", "user", "pass");
132+
final HttpCredentials httpCredentials = new HttpCredentials("user", "pass");
133+
httpCredentials.setOrigin(Utils.generateDifferentOriginPort(server));
134+
try (BrowserContext context = browser.newContext(new Browser.NewContextOptions().setHttpCredentials(httpCredentials))) {
135+
Page page = context.newPage();
136+
Response response = page.navigate(server.EMPTY_PAGE);
137+
assertEquals(401, response.status());
138+
}
139+
}
77140
}

‎playwright/src/test/java/com/microsoft/playwright/TestBrowserContextFetch.java‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -671,4 +671,67 @@ void shouldAbortRequestsWhenBrowserContextCloses() {
671671
e = assertThrows(PlaywrightException.class, () -> context.request().post(server.EMPTY_PAGE));
672672
assertTrue(e.getMessage().contains("Target page, context or browser has been closed"), e.getMessage());
673673
}
674+
675+
@Test
676+
void shouldWorkWithSetHTTPCredentialsAndMatchingOrigin() throws ExecutionException, InterruptedException {
677+
server.setAuth("/empty.html", "user", "pass");
678+
APIResponse response1 = context.request().get(server.EMPTY_PAGE);
679+
assertEquals(401, response1.status());
680+
681+
final HttpCredentials httpCredentials = new HttpCredentials("user", "pass");
682+
httpCredentials.setOrigin(server.PREFIX);
683+
try (BrowserContext context2 = browser.newContext(
684+
new Browser.NewContextOptions().setHttpCredentials(httpCredentials))) {
685+
APIResponse response2 = context2.request().get(server.EMPTY_PAGE);
686+
assertEquals(200, response2.status());
687+
}
688+
}
689+
690+
@Test
691+
void shouldWorkWithSetHTTPCredentialsAndMatchingOriginCaseInsensitive() throws ExecutionException, InterruptedException {
692+
server.setAuth("/empty.html", "user", "pass");
693+
APIResponse response1 = context.request().get(server.EMPTY_PAGE);
694+
assertEquals(401, response1.status());
695+
696+
final HttpCredentials httpCredentials = new HttpCredentials("user", "pass");
697+
httpCredentials.setOrigin(server.PREFIX.toUpperCase());
698+
try (BrowserContext context2 = browser.newContext(
699+
new Browser.NewContextOptions().setHttpCredentials(httpCredentials))) {
700+
APIResponse response2 = context2.request().get(server.EMPTY_PAGE);
701+
assertEquals(200, response2.status());
702+
}
703+
}
704+
705+
@Test
706+
void shouldReturnErrorWithCorrectCredentialsAndWrongOriginScheme() {
707+
server.setAuth("/empty.html", "user", "pass");
708+
final HttpCredentials httpCredentials = new HttpCredentials("user", "pass");
709+
httpCredentials.setOrigin(Utils.generateDifferentOriginScheme(server));
710+
try (BrowserContext context = browser.newContext(new Browser.NewContextOptions().setHttpCredentials(httpCredentials))) {
711+
APIResponse response = context.request().get(server.EMPTY_PAGE);
712+
assertEquals(401, response.status());
713+
}
714+
}
715+
716+
@Test
717+
void shouldReturnErrorWithCorrectCredentialsAndWrongOriginHostname() {
718+
server.setAuth("/empty.html", "user", "pass");
719+
final HttpCredentials httpCredentials = new HttpCredentials("user", "pass");
720+
httpCredentials.setOrigin(Utils.generateDifferentOriginHostname(server));
721+
try (BrowserContext context = browser.newContext(new Browser.NewContextOptions().setHttpCredentials(httpCredentials))) {
722+
APIResponse response = context.request().get(server.EMPTY_PAGE);
723+
assertEquals(401, response.status());
724+
}
725+
}
726+
727+
@Test
728+
void shouldReturnErrorWithCorrectCredentialsAndWrongOriginPort() {
729+
server.setAuth("/empty.html", "user", "pass");
730+
final HttpCredentials httpCredentials = new HttpCredentials("user", "pass");
731+
httpCredentials.setOrigin(Utils.generateDifferentOriginPort(server));
732+
try (BrowserContext context = browser.newContext(new Browser.NewContextOptions().setHttpCredentials(httpCredentials))) {
733+
APIResponse response = context.request().get(server.EMPTY_PAGE);
734+
assertEquals(401, response.status());
735+
}
736+
}
674737
}

‎playwright/src/test/java/com/microsoft/playwright/TestGlobalFetch.java‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
package com.microsoft.playwright;
22

33
import com.google.gson.Gson;
4+
import com.microsoft.playwright.options.HttpCredentials;
45
import com.microsoft.playwright.options.HttpHeader;
56
import com.microsoft.playwright.options.RequestOptions;
67
import org.junit.jupiter.api.Disabled;
@@ -411,4 +412,66 @@ void shouldNotModifyRequestMethodInOptions() {
411412
request.dispose();
412413
}
413414

415+
@Test
416+
void shouldSupportGlobalHttpCredentialsOptionAndMatchingOrigin() {
417+
server.setAuth("/empty.html", "user", "pass");
418+
APIRequestContext request1 = playwright.request().newContext();
419+
APIResponse response1 = request1.get(server.EMPTY_PAGE);
420+
assertEquals(401, response1.status());
421+
request1.dispose();
422+
423+
final HttpCredentials httpCredentials = new HttpCredentials("user", "pass");
424+
httpCredentials.setOrigin(server.PREFIX);
425+
APIRequestContext request2 = playwright.request().newContext(new APIRequest.NewContextOptions().setHttpCredentials(httpCredentials));
426+
APIResponse response2 = request2.get(server.EMPTY_PAGE);
427+
assertEquals(200, response2.status());
428+
request2.dispose();
429+
}
430+
431+
@Test
432+
void shouldSupportGlobalHttpCredentialsOptionAndMatchingOriginCaseInsensitive() {
433+
server.setAuth("/empty.html", "user", "pass");
434+
APIRequestContext request1 = playwright.request().newContext();
435+
APIResponse response1 = request1.get(server.EMPTY_PAGE);
436+
assertEquals(401, response1.status());
437+
request1.dispose();
438+
439+
final HttpCredentials httpCredentials = new HttpCredentials("user", "pass");
440+
httpCredentials.setOrigin(server.PREFIX.toUpperCase());
441+
APIRequestContext request2 = playwright.request().newContext(new APIRequest.NewContextOptions().setHttpCredentials(httpCredentials));
442+
APIResponse response2 = request2.get(server.EMPTY_PAGE);
443+
assertEquals(200, response2.status());
444+
request2.dispose();
445+
}
446+
447+
@Test
448+
void shouldReturnErrorWithCorrectCredentialsAndWrongOriginScheme() {
449+
server.setAuth("/empty.html", "user", "pass");
450+
final HttpCredentials httpCredentials = new HttpCredentials("user", "pass");
451+
httpCredentials.setOrigin(Utils.generateDifferentOriginScheme(server));
452+
APIRequestContext request = playwright.request().newContext(new APIRequest.NewContextOptions().setHttpCredentials(httpCredentials));
453+
APIResponse response = request.get(server.EMPTY_PAGE);
454+
assertEquals(401, response.status());
455+
}
456+
457+
@Test
458+
void shouldReturnErrorWithCorrectCredentialsAndWrongOriginHostname() {
459+
server.setAuth("/empty.html", "user", "pass");
460+
final HttpCredentials httpCredentials = new HttpCredentials("user", "pass");
461+
httpCredentials.setOrigin(Utils.generateDifferentOriginHostname(server));
462+
APIRequestContext request = playwright.request().newContext(new APIRequest.NewContextOptions().setHttpCredentials(httpCredentials));
463+
APIResponse response = request.get(server.EMPTY_PAGE);
464+
assertEquals(401, response.status());
465+
}
466+
467+
@Test
468+
void shouldReturnErrorWithCorrectCredentialsAndWrongOriginPort() {
469+
server.setAuth("/empty.html", "user", "pass");
470+
final HttpCredentials httpCredentials = new HttpCredentials("user", "pass");
471+
httpCredentials.setOrigin(Utils.generateDifferentOriginPort(server));
472+
APIRequestContext request = playwright.request().newContext(new APIRequest.NewContextOptions().setHttpCredentials(httpCredentials));
473+
APIResponse response = request.get(server.EMPTY_PAGE);
474+
assertEquals(401, response.status());
475+
}
476+
414477
}

‎playwright/src/test/java/com/microsoft/playwright/Utils.java‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -200,4 +200,18 @@ static void verifyViewport(Page page, int width, int height) {
200200
assertEquals(width, page.evaluate("window.innerWidth"));
201201
assertEquals(height, page.evaluate("window.innerHeight"));
202202
}
203+
204+
static String generateDifferentOriginScheme(final Server server){
205+
return server.PREFIX.startsWith("http://") ?
206+
server.PREFIX.replace("http://", "https://") :
207+
server.PREFIX.replace("https://", "http://");
208+
}
209+
210+
static String generateDifferentOriginHostname(final Server server){
211+
return server.PREFIX.replace("localhost", "mismatching-hostname");
212+
}
213+
214+
static String generateDifferentOriginPort(final Server server){
215+
return server.PREFIX.replace(String.valueOf(server.PORT), String.valueOf(server.PORT+1));
216+
}
203217
}

0 commit comments

Comments
 (0)