public_git/oauth2-proxy
1
0
Fork 0
mirror of https://github.com/oauth2-proxy/oauth2-proxy.git synced 2026-10-18 13:18:26 +02:00
Code Issues Projects Releases Wiki Activity

Stop accepting legacy SHA1 signed cookies

Browse Source
This commit is contained in:
Nick Meves
2020-09-24 10:31:34 -07:00
parent 55a941b76e
commit 56f199a24f
3 changed files with 7 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/encryption/utils_test.go
+2 -2
View File
@@ -94,8 +94,8 @@ func TestSignAndValidate(t *testing.T) {
assert.NoError(t, err)
assert.True(t, checkSignature(sha256sig, seed, key, value, epoch))
// This should be switched to False after fully deprecating SHA1
assert.True(t, checkSignature(sha1sig, seed, key, value, epoch))
// We don't validate legacy SHA1 signatures anymore
assert.False(t, checkSignature(sha1sig, seed, key, value, epoch))
assert.False(t, checkSignature(sha256sig, seed, key, "tampered", epoch))
assert.False(t, checkSignature(sha1sig, seed, key, "tampered", epoch))