Merge pull request #10364

f355f85 Harden HTTP client auth (Lee *!* Clagett)

1 files changed, 2 insertions, 35 deletions

diff --git a/tests/unit_tests/http.cpp b/tests/unit_tests/http.cpp
index f8eb0127b..1746ee190 100644
--- a/tests/unit_tests/http.cpp
+++ b/tests/unit_tests/http.cpp
@@ -614,10 +614,8 @@ TEST(HTTP_Client_Auth, BadSyntax)
 
 TEST(HTTP_Client_Auth, MD5)
 {
-  constexpr char method[] = "NOP";
   constexpr char nonce[] = "some crazy nonce";
   constexpr char realm[] = "the only realm";
-  constexpr char uri[] = "/some_file";
 
   const http::login user{"foo", "bar"};
   http::http_client_auth auth{user};
@@ -636,42 +634,11 @@ TEST(HTTP_Client_Auth, MD5)
     },
   });
 
-  EXPECT_EQ(http::http_client_auth::kSuccess, auth.handle_401(response));
-  const auto auth_field = auth.get_auth_field(method, uri);
-  ASSERT_TRUE(bool(auth_field));
-
-  const auto parsed = parse_fields(auth_field->second);
-  EXPECT_STREQ(u8"Authorization", auth_field->first.c_str());
-  EXPECT_EQ(parsed.end(), parsed.find(u8"opaque"));
-  EXPECT_EQ(parsed.end(), parsed.find(u8"qop"));
-  EXPECT_EQ(parsed.end(), parsed.find(u8"nc"));
-  EXPECT_STREQ(u8"MD5", parsed.at(u8"algorithm").c_str());
-  EXPECT_STREQ(nonce, parsed.at(u8"nonce").c_str());
-  EXPECT_STREQ(uri, parsed.at(u8"uri").c_str());
-  EXPECT_EQ(user.username, parsed.at(u8"username"));
-  EXPECT_STREQ(realm, parsed.at(u8"realm").c_str());
-
-  const std::string a1 = get_a1(user, parsed);
-  const std::string a2 = get_a2(uri);
-  const std::string auth_code = md5_hex(
-    boost::join(std::vector<std::string>{md5_hex(a1), nonce, md5_hex(a2)}, u8":")
-  );
-  EXPECT_TRUE(boost::iequals(auth_code, parsed.at(u8"response")));
-  {
-    const auto auth_field_dup = auth.get_auth_field(method, uri);
-    ASSERT_TRUE(bool(auth_field_dup));
-    EXPECT_EQ(*auth_field, *auth_field_dup);
-  }
-
-
-  EXPECT_EQ(http::http_client_auth::kBadPassword, auth.handle_401(response));
-  response.m_header_info.m_etc_fields.front().second.append(u8"," + write_fields({{u8"stale", u8"TRUE"}}));
-  EXPECT_EQ(http::http_client_auth::kSuccess, auth.handle_401(response));
+  EXPECT_EQ(http::http_client_auth::kParseFailure, auth.handle_401(response));
 }
 
 TEST(HTTP_Client_Auth, MD5_auth)
 {
-  constexpr char cnonce[] = "";
   constexpr char method[] = "NOP";
   constexpr char nonce[] = "some crazy nonce";
   constexpr char opaque[] = "this is the opaque";
@@ -723,7 +690,7 @@ TEST(HTTP_Client_Auth, MD5_auth)
     const std::string a1 = get_a1(user, parsed);
     const std::string a2 = get_a2(uri);
     const std::string auth_code = md5_hex(
-      boost::join(std::vector<std::string>{md5_hex(a1), nonce, nc, cnonce, u8"auth", md5_hex(a2)}, u8":")
+      boost::join(std::vector<std::string>{md5_hex(a1), nonce, nc, parsed.at(u8"cnonce"), u8"auth", md5_hex(a2)}, u8":")
     );
     EXPECT_TRUE(boost::iequals(auth_code, parsed.at(u8"response")));
   }