Skip to content

Commit 1219531

Browse files
agukasmmrts
agukasm
authored and
mrts
committed
feat: add Web eID custom JSON token validation
Signed-off-by: Mati Agukas <[email protected]>
1 parent 95a09f9 commit 1219531

27 files changed

+408
-173
lines changed

‎src/WebEid.Security.Tests/TestUtils/AuthTokenValidators.cs‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,6 @@ namespace WebEid.Security.Tests.TestUtils
44
using System.Security.Cryptography.X509Certificates;
55
using Security.Cache;
66
using Security.Validator;
7-
using Util;
87

98
public static class AuthTokenValidators
109
{

‎src/WebEid.Security.Tests/Validator/AuthTokenParserTests.cs‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ public class AuthTokenParserTests
1111
[Test]
1212
public void PopulateDataFromClaimsFillsCorrectDataAndValidationDoesNotFailFromValidToken()
1313
{
14-
var parser = new AuthTokenParser(Tokens.SignedTest, null);
14+
var parser = new JwtAuthTokenParser(Tokens.SignedTest, null);
1515
var data = parser.ParseHeaderFromTokenString();
1616
parser.ParseClaims();
1717
parser.PopulateDataFromClaims(data);
@@ -29,43 +29,43 @@ public void PopulateDataFromClaimsFillsCorrectDataAndValidationDoesNotFailFromVa
2929
[Test]
3030
public void ParseHeaderFromTokenStringWithMissingX5CFieldThrowsTokenParseException()
3131
{
32-
var parser = new AuthTokenParser(Tokens.X5CMissing, null);
32+
var parser = new JwtAuthTokenParser(Tokens.X5CMissing, null);
3333
Assert.Throws<TokenParseException>(() => parser.ParseHeaderFromTokenString());
3434
}
3535

3636
[Test]
3737
public void ParseHeaderFromTokenStringWithIncorrectX5CValueThrowsTokenParseException()
3838
{
39-
var parser = new AuthTokenParser(Tokens.X5CNotString, null);
39+
var parser = new JwtAuthTokenParser(Tokens.X5CNotString, null);
4040
Assert.Throws<TokenParseException>(() => parser.ParseHeaderFromTokenString());
4141
}
4242

4343
[Test]
4444
public void ParseHeaderFromTokenStringWithIncorrectX5CListValueThrowsTokenParseException()
4545
{
46-
var parser = new AuthTokenParser(Tokens.X5CNotArray, null);
46+
var parser = new JwtAuthTokenParser(Tokens.X5CNotArray, null);
4747
Assert.Throws<TokenParseException>(() => parser.ParseHeaderFromTokenString());
4848
}
4949

5050
[Test]
5151
public void ParseHeaderFromTokenStringWithX5CEmptyValueThrowsTokenParseException()
5252
{
53-
var parser = new AuthTokenParser(Tokens.X5CEmpty, null);
53+
var parser = new JwtAuthTokenParser(Tokens.X5CEmpty, null);
5454
Assert.Throws<TokenParseException>(() => parser.ParseHeaderFromTokenString());
5555
}
5656

5757
[Test]
5858
public void JwtWithoutDateFieldsDoesNotThrow()
5959
{
60-
var parser = new AuthTokenParser(Tokens.MinimalFormat, null);
60+
var parser = new JwtAuthTokenParser(Tokens.MinimalFormat, null);
6161
var validatorData = parser.ParseHeaderFromTokenString();
6262
Assert.DoesNotThrow(() => parser.ValidateTokenSignature(validatorData.SubjectCertificate));
6363
}
6464

6565
[Test]
6666
public void ParseHeaderFromTokenStringWithInvalidX5CCertificateThrowsTokenParseException()
6767
{
68-
var parser = new AuthTokenParser(Tokens.X5CInvalidCertificate, null);
68+
var parser = new JwtAuthTokenParser(Tokens.X5CInvalidCertificate, null);
6969
Assert.Throws<TokenParseException>(() => parser.ParseHeaderFromTokenString());
7070
}
7171
}

‎src/WebEid.Security.Tests/Validator/AuthTokenValidatorCertificateExpiryTests.cs‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,13 +19,17 @@ protected override void SetUp()
1919
[Test]
2020
public void TestTokenCertRsaExpired()
2121
{
22+
#pragma warning disable CS0618 // is obsolete
2223
Assert.ThrowsAsync<CertificateExpiredException>(async () => await this.validator.Validate(Tokens.TokenCertRsaExipred));
24+
#pragma warning restore CS0618
2325
}
2426

2527
[Test]
2628
public void TestTokenCertEcdsaExpired()
2729
{
30+
#pragma warning disable CS0618 // is obsolete
2831
Assert.ThrowsAsync<CertificateExpiredException>(async () => await this.validator.Validate(Tokens.TokenCertEcdsaExipred));
32+
#pragma warning restore CS0618
2933
}
3034
}
3135
}

‎src/WebEid.Security.Tests/Validator/AuthTokenValidatorFingerprintTests.cs‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,9 @@ public void ValidateFingerprint()
1313
{
1414
var validator = AuthTokenValidators.GetAuthTokenValidator(this.Cache,
1515
"urn:cert:sha-256:6f0df244e4a856b94b3b3b47582a0a51a32d674dbc7107211ed23d4bec6d9c72");
16+
#pragma warning disable CS0618 // is obsolete
1617
Assert.DoesNotThrow(() => validator.Validate(Tokens.SignedTest));
18+
#pragma warning restore CS0618
1719
}
1820

1921
[Test]
@@ -22,17 +24,21 @@ public void ValidateInvalidFingerprint()
2224
{
2325
var validator = AuthTokenValidators.GetAuthTokenValidator(this.Cache,
2426
"abcde6f0df244e4a856b94b3b3b47582a0a51a32d674dbc7107211ed23d4bec6d9c72");
27+
#pragma warning disable CS0618 // is obsolete
2528
Assert.ThrowsAsync<SiteCertificateFingerprintValidationException>(async () =>
2629
await validator.Validate(Tokens.SignedTest));
30+
#pragma warning restore CS0618
2731
}
2832

2933
[Test]
3034
public void TestMismatchingSiteCertificateFingerprint()
3135
{
3236
var validator = AuthTokenValidators.GetAuthTokenValidator(this.Cache,
3337
"urn:cert:sha-256:6f0df244e4a856b94b3b3b47582a0a51a32d674dbc7107211ed23d4bec6d9c72");
38+
#pragma warning disable CS0618 // is obsolete
3439
Assert.ThrowsAsync<SiteCertificateFingerprintValidationException>(async () =>
3540
await validator.Validate(Tokens.MismatchingSiteCertificateFingerprint));
41+
#pragma warning restore CS0618
3642
}
3743
}
3844
}

‎src/WebEid.Security.Tests/Validator/AuthTokenValidatorNonceTests.cs‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,9 @@ public void ValidateIncorrectNonce()
1616
{
1717
System.Fakes.ShimDateTime.UtcNowGet = () => new DateTime(2020, 4, 14, 13, 00, 00, DateTimeKind.Utc);
1818
this.PutIncorrectNonceToCache();
19+
#pragma warning disable CS0618 // is obsolete
1920
Assert.ThrowsAsync<NonceNotFoundException>(async () => await this.Validator.Validate(Tokens.SignedTest));
21+
#pragma warning restore CS0618
2022
}
2123
}
2224

@@ -27,7 +29,9 @@ public void ValidateExpiredNonce()
2729
{
2830
System.Fakes.ShimDateTime.UtcNowGet = () => new DateTime(2020, 4, 14, 13, 00, 00, DateTimeKind.Utc);
2931
this.PutExpiredNonceToCache();
32+
#pragma warning disable CS0618 // is obsolete
3033
Assert.ThrowsAsync<NonceExpiredException>(async () => await this.Validator.Validate(Tokens.SignedTest));
34+
#pragma warning restore CS0618
3135
}
3236
}
3337

@@ -37,8 +41,10 @@ public void MissingNonceThrowsTokenParseException()
3741
using (ShimsContext.Create())
3842
{
3943
System.Fakes.ShimDateTime.UtcNowGet = () => new DateTime(2020, 4, 14, 13, 00, 00, DateTimeKind.Utc);
44+
#pragma warning disable CS0618 // is obsolete
4045
Assert.ThrowsAsync<TokenParseException>(async () => await this.Validator.Validate(Tokens.NonceMissing))
4146
.HasMessageStartingWith("nonce field must be present and not empty in authentication token body");
47+
#pragma warning restore CS0618
4248
}
4349
}
4450

@@ -48,8 +54,10 @@ public void EmptyNonceThrowsTokenParseException()
4854
using (ShimsContext.Create())
4955
{
5056
System.Fakes.ShimDateTime.UtcNowGet = () => new DateTime(2020, 4, 14, 13, 00, 00, DateTimeKind.Utc);
57+
#pragma warning disable CS0618 // is obsolete
5158
Assert.ThrowsAsync<TokenParseException>(async () => await this.Validator.Validate(Tokens.NonceEmpty))
5259
.HasMessageStartingWith("nonce field must be present and not empty in authentication token body");
60+
#pragma warning restore CS0618
5361
}
5462
}
5563

@@ -59,8 +67,10 @@ public void TokenNonceNotStringThrowsTokenParseException()
5967
using (ShimsContext.Create())
6068
{
6169
System.Fakes.ShimDateTime.UtcNowGet = () => new DateTime(2020, 4, 14, 13, 00, 00, DateTimeKind.Utc);
70+
#pragma warning disable CS0618 // is obsolete
6271
Assert.ThrowsAsync<TokenParseException>(async () => await this.Validator.Validate(Tokens.NonceNotString))
6372
.HasMessageStartingWith("nonce field type must be string in authentication token body");
73+
#pragma warning restore CS0618
6474
}
6575
}
6676

@@ -71,7 +81,9 @@ public void TooShortNonceThrowsTokenParseException()
7181
{
7282
System.Fakes.ShimDateTime.UtcNowGet = () => new DateTime(2020, 4, 14, 13, 00, 00, DateTimeKind.Utc);
7383
this.PutTooShortNonceToCache();
84+
#pragma warning disable CS0618 // is obsolete
7485
Assert.ThrowsAsync<TokenParseException>(async () => await this.Validator.Validate(Tokens.NonceTooShort));
86+
#pragma warning restore CS0618
7587
}
7688
}
7789
}

‎src/WebEid.Security.Tests/Validator/AuthTokenValidatorOriginTests.cs‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,27 +12,35 @@ public class AuthTokenValidatorOriginTests : AbstractTestWithMockedDateValidator
1212
public void ValidateOriginMismatchFailure()
1313
{
1414
this.Validator = AuthTokenValidators.GetAuthTokenValidator("https://mismatch.ee", this.Cache);
15+
#pragma warning disable CS0618 // is obsolete
1516
Assert.ThrowsAsync<OriginMismatchException>(async () => await this.Validator.Validate(Tokens.SignedTest));
17+
#pragma warning restore CS0618
1618
}
1719

1820
[Test]
1921
public void TestOriginMissing()
2022
{
23+
#pragma warning disable CS0618 // is obsolete
2124
Assert.ThrowsAsync<TokenParseException>(async () => await this.Validator.Validate(Tokens.OriginMissing))
2225
.HasMessageStartingWith("aud field must be present in authentication token body and must be an array");
26+
#pragma warning restore CS0618
2327
}
2428

2529
[Test]
2630
public void TestOriginEmpty()
2731
{
32+
#pragma warning disable CS0618 // is obsolete
2833
Assert.ThrowsAsync<TokenParseException>(async () => await this.Validator.Validate(Tokens.OriginEmpty))
2934
.HasMessageStartingWith("origin from aud field must not be empty");
35+
#pragma warning restore CS0618
3036
}
3137

3238
[Test]
3339
public void TestOriginNotString()
3440
{
41+
#pragma warning disable CS0618 // is obsolete
3542
Assert.ThrowsAsync<OriginMismatchException>(async () => await this.Validator.Validate(Tokens.OriginNotString));
43+
#pragma warning restore CS0618
3644
}
3745

3846
[Test]
@@ -45,7 +53,9 @@ public void TestValidatorOriginNotUrl()
4553
[Test]
4654
public void TestTokenOriginNotUrl()
4755
{
56+
#pragma warning disable CS0618 // is obsolete
4857
Assert.ThrowsAsync<OriginMismatchException>(async () => await this.Validator.Validate(Tokens.OriginNotUrl));
58+
#pragma warning restore CS0618
4959
}
5060

5161
[Test]
@@ -60,7 +70,9 @@ public void TestValidatorOriginExcessiveElements()
6070
public void TestTokenOriginExcessiveElements()
6171
{
6272
var validator = AuthTokenValidators.GetAuthTokenValidator("https://ria.ee", this.Cache);
73+
#pragma warning disable CS0618 // is obsolete
6374
Assert.ThrowsAsync<OriginMismatchException>(async () => await validator.Validate(Tokens.OriginUrlWithExcessiveElements));
75+
#pragma warning restore CS0618
6476
}
6577

6678
[Test]
@@ -73,7 +85,9 @@ public void TestValidatorOriginNotHttps()
7385
public void TestTokenOriginNotHttps()
7486
{
7587
var validator = AuthTokenValidators.GetAuthTokenValidator("https://ria.ee", this.Cache);
88+
#pragma warning disable CS0618 // is obsolete
7689
Assert.ThrowsAsync<OriginMismatchException>(async () => await validator.Validate(Tokens.OriginValidUrlNotHttps));
90+
#pragma warning restore CS0618
7791
}
7892

7993
[Test]

‎src/WebEid.Security.Tests/Validator/AuthTokenValidatorTrustedCaTests.cs‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,9 @@ protected override void SetUp()
1919
[Test]
2020
public void DetectUntrustedUserCertificate()
2121
{
22+
#pragma warning disable CS0618 // is obsolete
2223
Assert.ThrowsAsync<CertificateNotTrustedException>(async () => await this.validator.Validate(Tokens.SignedTest));
24+
#pragma warning restore CS0618
2325
}
2426
}
2527
}

‎src/WebEid.Security.Tests/Validator/AuthTokenValidatorValidateTests.cs‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,9 @@ public void CertificateIsNotValidYet()
1616
{
1717
// Authentication token expires at 2020-04-14
1818
System.Fakes.ShimDateTime.UtcNowGet = () => new DateTime(2018, 10, 17, 0, 0, 0, DateTimeKind.Utc);
19+
#pragma warning disable CS0618 // is obsolete
1920
Assert.ThrowsAsync<CertificateNotYetValidException>(async () => await this.Validator.Validate(Tokens.SignedTest));
21+
#pragma warning restore CS0618
2022
}
2123
}
2224

@@ -27,22 +29,28 @@ public void CertificateIsNoLongerValid()
2729
{
2830
// Authentication token expires at 2020-04-14
2931
System.Fakes.ShimDateTime.UtcNowGet = () => new DateTime(2023, 10, 19, 0, 0, 0, DateTimeKind.Utc);
32+
#pragma warning disable CS0618 // is obsolete
3033
Assert.ThrowsAsync<CertificateExpiredException>(async () => await this.Validator.Validate(Tokens.SignedTest));
34+
#pragma warning restore CS0618
3135
}
3236
}
3337

3438
[Test]
3539
public void TokenTooShortThrowsExceptionWithMessage()
3640
{
41+
#pragma warning disable CS0618 // is obsolete
3742
Assert.ThrowsAsync<TokenParseException>(async () => await this.Validator.Validate(Tokens.TokenTooShort))
3843
.WithMessage("Auth token is null or too short");
44+
#pragma warning restore CS0618
3945
}
4046

4147
[Test]
4248
public void TokenTooLongThrowsExceptionWithMessage()
4349
{
50+
#pragma warning disable CS0618 // is obsolete
4451
Assert.ThrowsAsync<TokenParseException>(async () => await this.Validator.Validate(Tokens.TokenTooLong))
4552
.WithMessage("Auth token is too long");
53+
#pragma warning restore CS0618
4654
}
4755
}
4856
}

‎src/WebEid.Security.Tests/Validator/AuthTokenValidatorWithDisallowedEsteidPolicyTests.cs‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,9 @@ protected override void SetUp()
2121
public void TestX5CDisallowedPolicyCertificate()
2222
{
2323
this.PutCorrectNonceToCache();
24+
#pragma warning disable CS0618 // is obsolete
2425
Assert.ThrowsAsync<UserCertificateDisallowedPolicyException>(async () => await this.validator.Validate(Tokens.SignedTest));
26+
#pragma warning restore CS0618
2527
}
2628
}
2729
}

‎src/WebEid.Security.Tests/Validator/AuthTokenValidatorWithoutOcspTests.cs‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,9 @@ protected override void SetUp()
2424
public async Task ParseSignedToken()
2525
{
2626
this.PutCorrectNonceToCache();
27+
#pragma warning disable CS0618 // is obsolete
2728
var certificate = await this.validator.Validate(Tokens.SignedTest);
29+
#pragma warning restore CS0618
2830
Assert.AreEqual("JÕEORG,JAAK-KRISTJAN,38001085718", certificate.GetSubjectCn());
2931
Assert.AreEqual("Jaak-Kristjan", certificate.GetSubjectGivenName().ToTitleCase());
3032
Assert.AreEqual("Jõeorg", certificate.GetSubjectSurname().ToTitleCase());
@@ -35,14 +37,18 @@ public async Task ParseSignedToken()
3537
[Test]
3638
public void DetectUnsignedToken()
3739
{
40+
#pragma warning disable CS0618 // is obsolete
3841
Assert.ThrowsAsync<TokenSignatureValidationException>(async () =>
3942
await this.validator.Validate(Tokens.GetUnsignedTokenString()));
43+
#pragma warning restore CS0618
4044
}
4145

4246
[Test]
4347
public void DetectCorruptedToken()
4448
{
49+
#pragma warning disable CS0618 // is obsolete
4550
Assert.ThrowsAsync<TokenParseException>(async () => await this.validator.Validate(Tokens.Corrupted));
51+
#pragma warning restore CS0618
4652
}
4753
}
4854
}

0 commit comments

Comments
 (0)