gecko/netwerk/test/unit/test_authentication.js
Ben Bucksch 1e96bf1207 nsIAuthPrompt2: add PREVIOUS_FAILED, bug 521467, r=biesi, sr=bz
Add flag nsIAuthInformation.PREVIOUS_FAILED to notify the
login manager that the previous login attempt failed.
That allows it to show a prompt instead of using the
stored values (silently).

--HG--
extra : rebase_source : 5a725bba1ae34d030fd60ecd5d67c74317de5d4f
2010-02-12 17:55:11 +01:00

539 lines
15 KiB
JavaScript

// This file tests authentication prompt callbacks
// TODO NIT use do_check_eq(expected, actual) consistently, not sometimes eq(actual, expected)
do_load_httpd_js();
const FLAG_RETURN_FALSE = 1 << 0;
const FLAG_WRONG_PASSWORD = 1 << 1;
const FLAG_BOGUS_USER = 1 << 2;
const FLAG_PREVIOUS_FAILED = 1 << 3;
const nsIAuthPrompt2 = Components.interfaces.nsIAuthPrompt2;
const nsIAuthInformation = Components.interfaces.nsIAuthInformation;
function AuthPrompt1(flags) {
this.flags = flags;
}
AuthPrompt1.prototype = {
user: "guest",
pass: "guest",
expectedRealm: "secret",
QueryInterface: function authprompt_qi(iid) {
if (iid.equals(Components.interfaces.nsISupports) ||
iid.equals(Components.interfaces.nsIAuthPrompt))
return this;
throw Components.results.NS_ERROR_NO_INTERFACE;
},
prompt: function ap1_prompt(title, text, realm, save, defaultText, result) {
do_throw("unexpected prompt call");
},
promptUsernameAndPassword:
function ap1_promptUP(title, text, realm, savePW, user, pw)
{
// Note that the realm here isn't actually the realm. it's a pw mgr key.
do_check_eq("localhost:4444 (" + this.expectedRealm + ")", realm);
if (text.indexOf(this.expectedRealm) == -1)
do_throw("Text must indicate the realm");
if (text.indexOf("localhost") == -1)
do_throw("Text must indicate the hostname");
if (text.indexOf("4444") == -1)
do_throw("Text must indicate the port");
if (text.indexOf("-1") != -1)
do_throw("Text must contain negative numbers");
if (this.flags & FLAG_RETURN_FALSE)
return false;
if (this.flags & FLAG_BOGUS_USER)
this.user = "foo\nbar";
user.value = this.user;
if (this.flags & FLAG_WRONG_PASSWORD) {
pw.value = this.pass + ".wrong";
// Now clear the flag to avoid an infinite loop
this.flags &= ~FLAG_WRONG_PASSWORD;
} else {
pw.value = this.pass;
}
return true;
},
promptPassword: function ap1_promptPW(title, text, realm, save, pwd) {
do_throw("unexpected promptPassword call");
}
};
function AuthPrompt2(flags) {
this.flags = flags;
}
AuthPrompt2.prototype = {
user: "guest",
pass: "guest",
expectedRealm: "secret",
QueryInterface: function authprompt2_qi(iid) {
if (iid.equals(Components.interfaces.nsISupports) ||
iid.equals(Components.interfaces.nsIAuthPrompt2))
return this;
throw Components.results.NS_ERROR_NO_INTERFACE;
},
promptAuth:
function ap2_promptAuth(channel, level, authInfo)
{
var isNTLM = channel.URI.path.indexOf("ntlm") != -1;
var isDigest = channel.URI.path.indexOf("digest") != -1;
if (isNTLM)
this.expectedRealm = ""; // NTLM knows no realms
do_check_eq(this.expectedRealm, authInfo.realm);
var expectedLevel = (isNTLM || isDigest) ?
nsIAuthPrompt2.LEVEL_PW_ENCRYPTED :
nsIAuthPrompt2.LEVEL_NONE;
do_check_eq(expectedLevel, level);
var expectedFlags = nsIAuthInformation.AUTH_HOST;
if (this.flags & FLAG_PREVIOUS_FAILED)
expectedFlags |= nsIAuthInformation.PREVIOUS_FAILED;
if (isNTLM)
expectedFlags |= nsIAuthInformation.NEED_DOMAIN;
const kAllKnownFlags = 31; // Don't fail test for newly added flags
do_check_eq(expectedFlags, authInfo.flags & kAllKnownFlags);
var expectedScheme = isNTLM ? "ntlm" : isDigest ? "digest" : "basic";
do_check_eq(expectedScheme, authInfo.authenticationScheme);
// No passwords in the URL -> nothing should be prefilled
do_check_eq(authInfo.username, "");
do_check_eq(authInfo.password, "");
do_check_eq(authInfo.domain, "");
if (this.flags & FLAG_RETURN_FALSE)
{
this.flags |= FLAG_PREVIOUS_FAILED;
return false;
}
if (this.flags & FLAG_BOGUS_USER)
this.user = "foo\nbar";
authInfo.username = this.user;
if (this.flags & FLAG_WRONG_PASSWORD) {
authInfo.password = this.pass + ".wrong";
this.flags |= FLAG_PREVIOUS_FAILED;
// Now clear the flag to avoid an infinite loop
this.flags &= ~FLAG_WRONG_PASSWORD;
} else {
authInfo.password = this.pass;
this.flags &= ~FLAG_PREVIOUS_FAILED;
}
return true;
},
asyncPromptAuth: function ap2_async(chan, cb, ctx, lvl, info) {
throw Components.results.NS_ERROR_NOT_IMPLEMENTED;
}
};
function Requestor(flags, versions) {
this.flags = flags;
this.versions = versions;
}
Requestor.prototype = {
QueryInterface: function requestor_qi(iid) {
if (iid.equals(Components.interfaces.nsISupports) ||
iid.equals(Components.interfaces.nsIInterfaceRequestor))
return this;
throw Components.results.NS_ERROR_NO_INTERFACE;
},
getInterface: function requestor_gi(iid) {
if (this.versions & 1 &&
iid.equals(Components.interfaces.nsIAuthPrompt)) {
// Allow the prompt to store state by caching it here
if (!this.prompt1)
this.prompt1 = new AuthPrompt1(this.flags);
return this.prompt1;
}
if (this.versions & 2 &&
iid.equals(Components.interfaces.nsIAuthPrompt2)) {
// Allow the prompt to store state by caching it here
if (!this.prompt2)
this.prompt2 = new AuthPrompt2(this.flags);
return this.prompt2;
}
throw Components.results.NS_ERROR_NO_INTERFACE;
},
prompt1: null,
prompt2: null
};
function RealmTestRequestor() {}
RealmTestRequestor.prototype = {
QueryInterface: function realmtest_qi(iid) {
if (iid.equals(Components.interfaces.nsISupports) ||
iid.equals(Components.interfaces.nsIInterfaceRequestor) ||
iid.equals(Components.interfaces.nsIAuthPrompt2))
return this;
throw Components.results.NS_ERROR_NO_INTERFACE;
},
getInterface: function realmtest_interface(iid) {
if (iid.equals(Components.interfaces.nsIAuthPrompt2))
return this;
throw Components.results.NS_ERROR_NO_INTERFACE;
},
promptAuth: function realmtest_checkAuth(channel, level, authInfo) {
do_check_eq(authInfo.realm, '\\"foo_bar');
return false;
},
asyncPromptAuth: function realmtest_async(chan, cb, ctx, lvl, info) {
throw Components.results.NS_ERROR_NOT_IMPLEMENTED;
}
};
var listener = {
expectedCode: -1, // Uninitialized
onStartRequest: function test_onStartR(request, ctx) {
try {
if (!Components.isSuccessCode(request.status))
do_throw("Channel should have a success code!");
if (!(request instanceof Components.interfaces.nsIHttpChannel))
do_throw("Expecting an HTTP channel");
do_check_eq(request.responseStatus, this.expectedCode);
// The request should be succeeded iff we expect 200
do_check_eq(request.requestSucceeded, this.expectedCode == 200);
} catch (e) {
do_throw("Unexpected exception: " + e);
}
throw Components.results.NS_ERROR_ABORT;
},
onDataAvailable: function test_ODA() {
do_throw("Should not get any data!");
},
onStopRequest: function test_onStopR(request, ctx, status) {
do_check_eq(status, Components.results.NS_ERROR_ABORT);
if (current_test < (tests.length - 1)) {
// First, gotta clear the auth cache
Components.classes["@mozilla.org/network/http-auth-manager;1"]
.getService(Components.interfaces.nsIHttpAuthManager)
.clearAll();
current_test++;
tests[current_test]();
} else {
do_test_pending();
httpserv.stop(do_test_finished);
}
do_test_finished();
}
};
function makeChan(url) {
var ios = Components.classes["@mozilla.org/network/io-service;1"]
.getService(Components.interfaces.nsIIOService);
var chan = ios.newChannel(url, null, null)
.QueryInterface(Components.interfaces.nsIHttpChannel);
return chan;
}
var tests = [test_noauth, test_returnfalse1, test_wrongpw1, test_prompt1,
test_returnfalse2, test_wrongpw2, test_prompt2, test_ntlm,
test_auth, test_digest_noauth, test_digest,
test_digest_bogus_user];
var current_test = 0;
var httpserv = null;
function run_test() {
httpserv = new nsHttpServer();
httpserv.registerPathHandler("/auth", authHandler);
httpserv.registerPathHandler("/auth/ntlm/simple", authNtlmSimple);
httpserv.registerPathHandler("/auth/realm", authRealm);
httpserv.registerPathHandler("/auth/digest", authDigest);
httpserv.start(4444);
tests[0]();
}
function test_noauth() {
var chan = makeChan("http://localhost:4444/auth");
listener.expectedCode = 401; // Unauthorized
chan.asyncOpen(listener, null);
do_test_pending();
}
function test_returnfalse1() {
var chan = makeChan("http://localhost:4444/auth");
chan.notificationCallbacks = new Requestor(FLAG_RETURN_FALSE, 1);
listener.expectedCode = 401; // Unauthorized
chan.asyncOpen(listener, null);
do_test_pending();
}
function test_wrongpw1() {
var chan = makeChan("http://localhost:4444/auth");
chan.notificationCallbacks = new Requestor(FLAG_WRONG_PASSWORD, 1);
listener.expectedCode = 200; // OK
chan.asyncOpen(listener, null);
do_test_pending();
}
function test_prompt1() {
var chan = makeChan("http://localhost:4444/auth");
chan.notificationCallbacks = new Requestor(0, 1);
listener.expectedCode = 200; // OK
chan.asyncOpen(listener, null);
do_test_pending();
}
function test_returnfalse2() {
var chan = makeChan("http://localhost:4444/auth");
chan.notificationCallbacks = new Requestor(FLAG_RETURN_FALSE, 2);
listener.expectedCode = 401; // Unauthorized
chan.asyncOpen(listener, null);
do_test_pending();
}
function test_wrongpw2() {
var chan = makeChan("http://localhost:4444/auth");
chan.notificationCallbacks = new Requestor(FLAG_WRONG_PASSWORD, 2);
listener.expectedCode = 200; // OK
chan.asyncOpen(listener, null);
do_test_pending();
}
function test_prompt2() {
var chan = makeChan("http://localhost:4444/auth");
chan.notificationCallbacks = new Requestor(0, 2);
listener.expectedCode = 200; // OK
chan.asyncOpen(listener, null);
do_test_pending();
}
function test_ntlm() {
var chan = makeChan("http://localhost:4444/auth/ntlm/simple");
chan.notificationCallbacks = new Requestor(FLAG_RETURN_FALSE, 2);
listener.expectedCode = 401; // Unauthorized
chan.asyncOpen(listener, null);
do_test_pending();
}
function test_auth() {
var chan = makeChan("http://localhost:4444/auth/realm");
chan.notificationCallbacks = new RealmTestRequestor();
listener.expectedCode = 401; // Unauthorized
chan.asyncOpen(listener, null);
do_test_pending();
}
function test_digest_noauth() {
var chan = makeChan("http://localhost:4444/auth/digest");
//chan.notificationCallbacks = new Requestor(FLAG_RETURN_FALSE, 2);
listener.expectedCode = 401; // Unauthorized
chan.asyncOpen(listener, null);
do_test_pending();
}
function test_digest() {
var chan = makeChan("http://localhost:4444/auth/digest");
chan.notificationCallbacks = new Requestor(0, 2);
listener.expectedCode = 200; // OK
chan.asyncOpen(listener, null);
do_test_pending();
}
function test_digest_bogus_user() {
var chan = makeChan("http://localhost:4444/auth/digest");
chan.notificationCallbacks = new Requestor(FLAG_BOGUS_USER, 2);
listener.expectedCode = 401; // unauthorized
chan.asyncOpen(listener, null);
do_test_pending();
}
// PATH HANDLERS
// /auth
function authHandler(metadata, response) {
// btoa("guest:guest"), but that function is not available here
var expectedHeader = "Basic Z3Vlc3Q6Z3Vlc3Q=";
var body;
if (metadata.hasHeader("Authorization") &&
metadata.getHeader("Authorization") == expectedHeader)
{
response.setStatusLine(metadata.httpVersion, 200, "OK, authorized");
response.setHeader("WWW-Authenticate", 'Basic realm="secret"', false);
body = "success";
}
else
{
// didn't know guest:guest, failure
response.setStatusLine(metadata.httpVersion, 401, "Unauthorized");
response.setHeader("WWW-Authenticate", 'Basic realm="secret"', false);
body = "failed";
}
response.bodyOutputStream.write(body, body.length);
}
// /auth/ntlm/simple
function authNtlmSimple(metadata, response) {
response.setStatusLine(metadata.httpVersion, 401, "Unauthorized");
response.setHeader("WWW-Authenticate", "NTLM" /* + ' realm="secret"' */, false);
var body = "NOTE: This just sends an NTLM challenge, it never\n" +
"accepts the authentication. It also closes\n" +
"the connection after sending the challenge\n";
response.bodyOutputStream.write(body, body.length);
}
// /auth/realm
function authRealm(metadata, response) {
response.setStatusLine(metadata.httpVersion, 401, "Unauthorized");
response.setHeader("WWW-Authenticate", 'Basic realm="\\"foo_bar"', false);
var body = "success";
response.bodyOutputStream.write(body, body.length);
}
//
// Digest functions
//
function bytesFromString(str) {
var converter =
Components.classes["@mozilla.org/intl/scriptableunicodeconverter"]
.createInstance(Components.interfaces.nsIScriptableUnicodeConverter);
converter.charset = "UTF-8";
var data = converter.convertToByteArray(str);
return data;
}
// return the two-digit hexadecimal code for a byte
function toHexString(charCode) {
return ("0" + charCode.toString(16)).slice(-2);
}
function H(str) {
var data = bytesFromString(str);
var ch = Components.classes["@mozilla.org/security/hash;1"]
.createInstance(Components.interfaces.nsICryptoHash);
ch.init(Components.interfaces.nsICryptoHash.MD5);
ch.update(data, data.length);
var hash = ch.finish(false);
return [toHexString(hash.charCodeAt(i)) for (i in hash)].join("");
}
//
// Digest handler
//
// /auth/digest
function authDigest(metadata, response) {
var nonce = "6f93719059cf8d568005727f3250e798";
var opaque = "1234opaque1234";
var cnonceRE = /cnonce="(\w+)"/;
var responseRE = /response="(\w+)"/;
var usernameRE = /username="(\w+)"/;
var authenticate = 'Digest realm="secret", domain="/", qop=auth,' +
'algorithm=MD5, nonce="' + nonce+ '" opaque="' +
opaque + '"';
var body;
// check creds if we have them
if (metadata.hasHeader("Authorization")) {
var auth = metadata.getHeader("Authorization");
var cnonce = (auth.match(cnonceRE))[1];
var clientDigest = (auth.match(responseRE))[1];
var username = (auth.match(usernameRE))[1];
var nc = "00000001";
if (username != "guest") {
response.setStatusLine(metadata.httpVersion, 400, "bad request");
body = "should never get here";
} else {
// see RFC2617 for the description of this calculation
var A1 = "guest:secret:guest";
var A2 = "GET:/auth/digest";
var noncebits = [nonce, nc, cnonce, "auth", H(A2)].join(":");
var digest = H([H(A1), noncebits].join(":"));
if (clientDigest == digest) {
response.setStatusLine(metadata.httpVersion, 200, "OK, authorized");
body = "success";
} else {
response.setStatusLine(metadata.httpVersion, 401, "Unauthorized");
response.setHeader("WWW-Authenticate", authenticate, false);
body = "auth failed";
}
}
} else {
// no header, send one
response.setStatusLine(metadata.httpVersion, 401, "Unauthorized");
response.setHeader("WWW-Authenticate", authenticate, false);
body = "failed, no header";
}
response.bodyOutputStream.write(body, body.length);
}