Rob Crittenden 86b073a7f0 Integration tests for verifying Referer header in the UI ...

Validate that the change_password and login_password endpoints
verify the HTTP Referer header. There is some overlap in the
tests: belt and suspenders.

All endpoints except session/login_x509 are covered, sometimes
having to rely on expected bad results (see the i18n endpoint).

session/login_x509 is not tested yet as it requires significant
additional setup in order to associate a user certificate with
a user entry, etc.

This can be manually verified by modifying /etc/httpd/conf.d/ipa.conf
and adding:

Satisfy Any
Require all granted

Then comment out Auth and SSLVerify, etc. and restart httpd.

With a valid Referer will fail with a 401 and log that there is no
KRB5CCNAME. This comes after the referer check.

With an invalid Referer it will fail with a 400 Bad Request as
expected.

CVE-2023-5455

Signed-off-by: Rob Crittenden <rcritten@redhat.com>

2024-01-10 10:27:06 +01:00

..

data

ipa-otptoken-import: Make PBKDF2 refer to the pkcs5 namespace

2017-09-01 10:50:34 +02:00

test_install

pylint: Fix useless-object-inheritance

2023-01-10 08:30:58 +01:00

__init__.py

pytest 3.x compatibility

2017-03-27 18:03:14 +02:00

httptest.py

Integration tests for verifying Referer header in the UI

2024-01-10 10:27:06 +01:00

test_adtrust_mockup.py

pytest: Migrate unittest/nose to Pytest fixtures

2020-02-12 18:08:32 +02:00

test_changepw.py

Integration tests for verifying Referer header in the UI

2024-01-10 10:27:06 +01:00

test_dnssec.py

ipapython: move dnssec, p11helper and secrets to ipaserver

2016-11-29 14:50:51 +01:00

test_i18n_messages.py

Add tests for "i18n_messages" end point

2018-07-17 15:32:28 -04:00

test_ipap11helper.py

Py3: Remove subclassing from object

2018-09-27 11:49:04 +02:00

test_jsplugins.py

ipatests: Skip test_jsplugins in server less environments

2021-03-30 13:16:36 +03:00

test_kadmin.py

ipa-kdb: test kadmin.local getprincs command

2020-09-10 11:57:14 -04:00

test_ldap.py

support more DateTime attributes in LDAP searches in IPA API

2023-08-21 16:28:04 +02:00

test_login_password.py

Integration tests for verifying Referer header in the UI

2024-01-10 10:27:06 +01:00

test_migratepw.py

pytest: Migrate xunit-style setups to Pytest fixtures

2020-02-12 18:08:32 +02:00

test_otptoken_import.py

Py3: Remove subclassing from object

2018-09-27 11:49:04 +02:00

test_referer.py

Integration tests for verifying Referer header in the UI

2024-01-10 10:27:06 +01:00

test_rpcserver.py

Py3: Remove subclassing from object

2018-09-27 11:49:04 +02:00

test_secrets.py

pytest: Migrate unittest/nose to Pytest fixtures

2020-02-12 18:08:32 +02:00

test_secure_ajp_connector.py

pylint: remove useless suppression

2023-01-10 08:30:58 +01:00

test_serverroles.py

Use api.env.container_sysaccounts

2020-04-28 11:28:29 +02:00

test_topology_plugin.py

ds: Support renaming of a replication plugin in 389-ds

2021-06-01 17:09:28 +03:00

test_version_comparison.py

Py3: Remove subclassing from object

2018-09-27 11:49:04 +02:00