Skip to content

Commit 67459dc

Browse files
kjdevkjdev
committed
test: add limit_except context
1 parent bb676de commit 67459dc

19 files changed

+577
-0
lines changed

‎t/auth_jwt.t‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -401,3 +401,42 @@ X-Jwt-Claim-Aud: test3.audience.example.com
401401
X-Jwt-Claim-Email: test3@example.com
402402
WWW-Authenticate: Bearer realm=""
403403
--- error_code: 200
404+
405+
=== limit_except
406+
--- http_config
407+
include $TEST_NGINX_CONF_DIR/authorized_server.conf;
408+
map $http_x_id $jwt {
409+
"test1" $test1_jwt;
410+
"test2" $test2_jwt;
411+
default "";
412+
}
413+
--- config
414+
include $TEST_NGINX_CONF_DIR/jwt.conf;
415+
location / {
416+
limit_except GET {
417+
auth_jwt "" token=$jwt;
418+
auth_jwt_key_file $TEST_NGINX_DATA_DIR/jwks.json;
419+
}
420+
include $TEST_NGINX_CONF_DIR/authorized_proxy.conf;
421+
}
422+
--- request eval
423+
[
424+
"GET /",
425+
"GET /",
426+
"POST /",
427+
"POST /"
428+
]
429+
--- more_headers eval
430+
[
431+
"X-Id: empty",
432+
"X-Id: test1",
433+
"X-Id: empty",
434+
"X-Id: test2"
435+
]
436+
--- error_code eval
437+
[
438+
200,
439+
200,
440+
401,
441+
200
442+
]

‎t/auth_jwt_key_file.t‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -648,3 +648,42 @@ X-Jwt-Claim-Aud: test1.audience.example.com
648648
X-Jwt-Claim-Email: [email protected]
649649
--- error_code: 200
650650
--- error_log: auth_jwt: rejected due to signature validate failure: kid="test1"
651+
652+
=== limit_except
653+
--- http_config
654+
include $TEST_NGINX_CONF_DIR/authorized_server.conf;
655+
map $http_x_id $jwt {
656+
"test1" $test1_jwt;
657+
"test2" $test2_jwt;
658+
}
659+
--- config
660+
include $TEST_NGINX_CONF_DIR/jwt.conf;
661+
location / {
662+
auth_jwt "" token=$jwt;
663+
auth_jwt_key_file $TEST_NGINX_DATA_DIR/test1.jwks;
664+
limit_except GET {
665+
auth_jwt_key_file $TEST_NGINX_DATA_DIR/test2.jwks;
666+
}
667+
include $TEST_NGINX_CONF_DIR/authorized_proxy.conf;
668+
}
669+
--- request eval
670+
[
671+
"GET /",
672+
"GET /",
673+
"POST /",
674+
"POST /"
675+
]
676+
--- more_headers eval
677+
[
678+
"X-Id: test1",
679+
"X-Id: test2",
680+
"X-Id: test1",
681+
"X-Id: test2"
682+
]
683+
--- error_code eval
684+
[
685+
200,
686+
401,
687+
200,
688+
200
689+
]

‎t/auth_jwt_key_request.t‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -725,3 +725,44 @@ X-Jwt-Claim-Aud: test1.audience.example.com
725725
X-Jwt-Claim-Email: [email protected]
726726
--- error_code: 200
727727
--- error_log: auth_jwt: rejected due to signature validate failure: kid="test1"
728+
729+
=== limit_except
730+
--- http_config
731+
include $TEST_NGINX_CONF_DIR/authorized_server.conf;
732+
map $http_x_id $jwt {
733+
"test1" $test1_jwt;
734+
"test2" $test2_jwt;
735+
}
736+
--- config
737+
include $TEST_NGINX_CONF_DIR/jwt.conf;
738+
location / {
739+
auth_jwt "" token=$jwt;
740+
auth_jwt_key_request /test1.jwks;
741+
limit_except GET {
742+
auth_jwt_key_request /test2.jwks;
743+
}
744+
include $TEST_NGINX_CONF_DIR/authorized_proxy.conf;
745+
}
746+
set $data_dir $TEST_NGINX_DATA_DIR;
747+
include $TEST_NGINX_CONF_DIR/key.conf;
748+
--- request eval
749+
[
750+
"GET /",
751+
"GET /",
752+
"POST /",
753+
"POST /"
754+
]
755+
--- more_headers eval
756+
[
757+
"X-Id: test1",
758+
"X-Id: test2",
759+
"X-Id: test1",
760+
"X-Id: test2"
761+
]
762+
--- error_code eval
763+
[
764+
200,
765+
401,
766+
200,
767+
200
768+
]

‎t/auth_jwt_require.t‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -456,3 +456,50 @@ location / {
456456
auth_jwt_require "iss";
457457
}
458458
--- must_die
459+
460+
=== limit_except
461+
--- http_config
462+
include $TEST_NGINX_CONF_DIR/authorized_server.conf;
463+
map $http_x_id $jwt {
464+
"test1" $test1_jwt;
465+
"test2" $test2_jwt;
466+
}
467+
map $jwt_claim_iss $valid_jwt_iss {
468+
"https://test1.issuer.example.com" 1;
469+
"https://test2.issuer.example.com" 1;
470+
}
471+
map $jwt_claim_sub $valid_jwt_sub {
472+
"test2.identifier" 1;
473+
}
474+
--- config
475+
include $TEST_NGINX_CONF_DIR/jwt.conf;
476+
location / {
477+
auth_jwt "" token=$jwt;
478+
auth_jwt_key_file $TEST_NGINX_DATA_DIR/jwks.json;
479+
auth_jwt_require $valid_jwt_iss;
480+
limit_except GET {
481+
auth_jwt_require $valid_jwt_sub;
482+
}
483+
include $TEST_NGINX_CONF_DIR/authorized_proxy.conf;
484+
}
485+
--- request eval
486+
[
487+
"GET /",
488+
"GET /",
489+
"POST /",
490+
"POST /"
491+
]
492+
--- more_headers eval
493+
[
494+
"X-Id: test1",
495+
"X-Id: test2",
496+
"X-Id: test1",
497+
"X-Id: test2"
498+
]
499+
--- error_code eval
500+
[
501+
200,
502+
200,
503+
401,
504+
200
505+
]

‎t/auth_jwt_require_claim.t‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -120,3 +120,43 @@ location / {
120120
auth_jwt: failed to json load claim requirement: exp
121121
--- log_level
122122
error
123+
124+
=== limit_except
125+
--- http_config
126+
include $TEST_NGINX_CONF_DIR/authorized_server.conf;
127+
map $http_x_id $jwt {
128+
"test1" $test1_jwt;
129+
"test2" $test2_jwt;
130+
}
131+
--- config
132+
include $TEST_NGINX_CONF_DIR/jwt.conf;
133+
location / {
134+
auth_jwt "" token=$jwt;
135+
auth_jwt_key_file $TEST_NGINX_DATA_DIR/jwks.json;
136+
auth_jwt_require_claim iss intersect json=["https://test1.issuer.example.com","https://test2.issuer.example.com"];
137+
limit_except GET {
138+
auth_jwt_require_claim sub eq "test2.identifier";
139+
}
140+
include $TEST_NGINX_CONF_DIR/authorized_proxy.conf;
141+
}
142+
--- request eval
143+
[
144+
"GET /",
145+
"GET /",
146+
"POST /",
147+
"POST /"
148+
]
149+
--- more_headers eval
150+
[
151+
"X-Id: test1",
152+
"X-Id: test2",
153+
"X-Id: test1",
154+
"X-Id: test2"
155+
]
156+
--- error_code eval
157+
[
158+
200,
159+
200,
160+
401,
161+
200
162+
]

‎t/auth_jwt_require_header.t‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -94,3 +94,43 @@ location / {
9494
auth_jwt: failed to json load header requirement: kid
9595
--- log_level
9696
error
97+
98+
=== limit_except
99+
--- http_config
100+
include $TEST_NGINX_CONF_DIR/authorized_server.conf;
101+
map $http_x_id $jwt {
102+
"test1" $test1_jwt;
103+
"test2" $test2_jwt;
104+
}
105+
--- config
106+
include $TEST_NGINX_CONF_DIR/jwt.conf;
107+
location / {
108+
auth_jwt "" token=$jwt;
109+
auth_jwt_key_file $TEST_NGINX_DATA_DIR/jwks.json;
110+
auth_jwt_require_header alg intersect json=["HS256","HS384"];
111+
limit_except GET {
112+
auth_jwt_require_header kid eq "test2";
113+
}
114+
include $TEST_NGINX_CONF_DIR/authorized_proxy.conf;
115+
}
116+
--- request eval
117+
[
118+
"GET /",
119+
"GET /",
120+
"POST /",
121+
"POST /"
122+
]
123+
--- more_headers eval
124+
[
125+
"X-Id: test1",
126+
"X-Id: test2",
127+
"X-Id: test1",
128+
"X-Id: test2"
129+
]
130+
--- error_code eval
131+
[
132+
200,
133+
200,
134+
401,
135+
200
136+
]

‎t/auth_jwt_revocation_list_kid.t‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -146,3 +146,43 @@ location / {
146146
--- error_code: 401
147147
--- error_log
148148
auth_jwt: rejected due to kid cannot be empty when revocation_kids set
149+
150+
=== limit_except
151+
--- http_config
152+
include $TEST_NGINX_CONF_DIR/authorized_server.conf;
153+
map $http_x_id $jwt {
154+
"test1" $test1_jwt;
155+
"test2" $test2_jwt;
156+
}
157+
--- config
158+
include $TEST_NGINX_CONF_DIR/jwt.conf;
159+
location / {
160+
auth_jwt "" token=$jwt;
161+
auth_jwt_key_file $TEST_NGINX_DATA_DIR/jwks.json;
162+
auth_jwt_revocation_list_kid $TEST_NGINX_DATA_DIR/revocation_kid_list/empty_revocation_kid_list.json;
163+
limit_except GET {
164+
auth_jwt_revocation_list_kid $TEST_NGINX_DATA_DIR/revocation_kid_list/revocation_kid_list.json;
165+
}
166+
include $TEST_NGINX_CONF_DIR/authorized_proxy.conf;
167+
}
168+
--- request eval
169+
[
170+
"GET /",
171+
"GET /",
172+
"POST /",
173+
"POST /"
174+
]
175+
--- more_headers eval
176+
[
177+
"X-Id: test1",
178+
"X-Id: test2",
179+
"X-Id: test1",
180+
"X-Id: test2"
181+
]
182+
--- error_code eval
183+
[
184+
200,
185+
200,
186+
200,
187+
401
188+
]

‎t/auth_jwt_revocation_list_sub.t‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -114,3 +114,43 @@ location / {
114114
--- error_code: 401
115115
--- error_log
116116
auth_jwt: rejected due to sub in revocation list: sub="test2.identifier"
117+
118+
=== limit_except
119+
--- http_config
120+
include $TEST_NGINX_CONF_DIR/authorized_server.conf;
121+
map $http_x_id $jwt {
122+
"test1" $test1_jwt;
123+
"test2" $test2_jwt;
124+
}
125+
--- config
126+
include $TEST_NGINX_CONF_DIR/jwt.conf;
127+
location / {
128+
auth_jwt "" token=$jwt;
129+
auth_jwt_key_file $TEST_NGINX_DATA_DIR/jwks.json;
130+
auth_jwt_revocation_list_sub $TEST_NGINX_DATA_DIR/revocation_list_sub/empty_revocation_list_sub.json;
131+
limit_except GET {
132+
auth_jwt_revocation_list_sub $TEST_NGINX_DATA_DIR/revocation_list_sub/revocation_list_sub.json;
133+
}
134+
include $TEST_NGINX_CONF_DIR/authorized_proxy.conf;
135+
}
136+
--- request eval
137+
[
138+
"GET /",
139+
"GET /",
140+
"POST /",
141+
"POST /"
142+
]
143+
--- more_headers eval
144+
[
145+
"X-Id: test1",
146+
"X-Id: test2",
147+
"X-Id: test1",
148+
"X-Id: test2"
149+
]
150+
--- error_code eval
151+
[
152+
200,
153+
200,
154+
200,
155+
401
156+
]

‎t/auth_jwt_validate_exp.t‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -134,3 +134,28 @@ X-Jwt-Claim-Email:
134134
--- error_code: 401
135135
--- error_log: auth_jwt: rejected due to exp claim could not be obtained
136136
--- log_level: info
137+
138+
=== limit_except
139+
--- http_config
140+
include $TEST_NGINX_CONF_DIR/authorized_server.conf;
141+
--- config
142+
include $TEST_NGINX_CONF_DIR/jwt.conf;
143+
location / {
144+
auth_jwt "" token=$test1_invalid_exp_jwt;
145+
auth_jwt_key_file $TEST_NGINX_DATA_DIR/jwks.json;
146+
auth_jwt_validate_exp off;
147+
limit_except GET {
148+
auth_jwt_validate_exp on;
149+
}
150+
include $TEST_NGINX_CONF_DIR/authorized_proxy.conf;
151+
}
152+
--- request eval
153+
[
154+
"GET /",
155+
"POST /"
156+
]
157+
--- error_code eval
158+
[
159+
200,
160+
401
161+
]

0 commit comments

Comments
 (0)