Rob Crittenden 86b073a7f0 Integration tests for verifying Referer header in the UI ... Validate that the change_password and login_password endpoints verify the HTTP Referer header. There is some overlap in the tests: belt and suspenders. All endpoints except session/login_x509 are covered, sometimes having to rely on expected bad results (see the i18n endpoint). session/login_x509 is not tested yet as it requires significant additional setup in order to associate a user certificate with a user entry, etc. This can be manually verified by modifying /etc/httpd/conf.d/ipa.conf and adding: Satisfy Any Require all granted Then comment out Auth and SSLVerify, etc. and restart httpd. With a valid Referer will fail with a 401 and log that there is no KRB5CCNAME. This comes after the referer check. With an invalid Referer it will fail with a 400 Bad Request as expected. CVE-2023-5455 Signed-off-by: Rob Crittenden <rcritten@redhat.com>		2024-01-10 10:27:06 +01:00
..
data	ipa-otptoken-import: Make PBKDF2 refer to the pkcs5 namespace	2017-09-01 10:50:34 +02:00
test_install	pylint: Fix useless-object-inheritance	2023-01-10 08:30:58 +01:00
__init__.py	pytest 3.x compatibility	2017-03-27 18:03:14 +02:00
httptest.py	Integration tests for verifying Referer header in the UI	2024-01-10 10:27:06 +01:00
test_adtrust_mockup.py	pytest: Migrate unittest/nose to Pytest fixtures	2020-02-12 18:08:32 +02:00
test_changepw.py	Integration tests for verifying Referer header in the UI	2024-01-10 10:27:06 +01:00
test_dnssec.py	ipapython: move dnssec, p11helper and secrets to ipaserver	2016-11-29 14:50:51 +01:00
test_i18n_messages.py	Add tests for "i18n_messages" end point	2018-07-17 15:32:28 -04:00
test_ipap11helper.py	Py3: Remove subclassing from object	2018-09-27 11:49:04 +02:00
test_jsplugins.py	ipatests: Skip test_jsplugins in server less environments	2021-03-30 13:16:36 +03:00
test_kadmin.py	ipa-kdb: test kadmin.local getprincs command	2020-09-10 11:57:14 -04:00
test_ldap.py	support more DateTime attributes in LDAP searches in IPA API	2023-08-21 16:28:04 +02:00
test_login_password.py	Integration tests for verifying Referer header in the UI	2024-01-10 10:27:06 +01:00
test_migratepw.py	pytest: Migrate xunit-style setups to Pytest fixtures	2020-02-12 18:08:32 +02:00
test_otptoken_import.py	Py3: Remove subclassing from object	2018-09-27 11:49:04 +02:00
test_referer.py	Integration tests for verifying Referer header in the UI	2024-01-10 10:27:06 +01:00
test_rpcserver.py	Py3: Remove subclassing from object	2018-09-27 11:49:04 +02:00
test_secrets.py	pytest: Migrate unittest/nose to Pytest fixtures	2020-02-12 18:08:32 +02:00
test_secure_ajp_connector.py	pylint: remove useless suppression	2023-01-10 08:30:58 +01:00
test_serverroles.py	Use api.env.container_sysaccounts	2020-04-28 11:28:29 +02:00
test_topology_plugin.py	ds: Support renaming of a replication plugin in 389-ds	2021-06-01 17:09:28 +03:00
test_version_comparison.py	Py3: Remove subclassing from object	2018-09-27 11:49:04 +02:00