def test_introspect_unsupported_token(self): endpoint = IntrospectEndpoint(self.validator, supported_token_types=['access_token']) body = urlencode([('token', 'foo'), ('token_type_hint', 'refresh_token')]) h, b, s = endpoint.create_introspect_response(self.uri, headers=self.headers, body=body) self.assertEqual(h, self.resp_h) self.assertEqual(loads(b)['error'], 'unsupported_token_type') self.assertEqual(s, 400) h, b, s = endpoint.create_introspect_response(self.uri, headers=self.headers, body='') self.assertEqual(h, self.resp_h) self.assertEqual(loads(b)['error'], 'invalid_request') self.assertEqual(s, 400)
def test_introspect_unsupported_token(self): endpoint = IntrospectEndpoint(self.validator, supported_token_types=['access_token']) body = urlencode([('token', 'foo'), ('token_type_hint', 'refresh_token')]) h, b, s = endpoint.create_introspect_response(self.uri, headers=self.headers, body=body) self.assertEqual(h, self.resp_h) self.assertEqual(loads(b)['error'], 'unsupported_token_type') self.assertEqual(s, 400) h, b, s = endpoint.create_introspect_response(self.uri, headers=self.headers, body='') self.assertEqual(h, self.resp_h) self.assertEqual(loads(b)['error'], 'invalid_request') self.assertEqual(s, 400)
def setUp(self): self.validator = MagicMock(wraps=RequestValidator()) self.validator.client_authentication_required.return_value = True self.validator.authenticate_client.return_value = True self.validator.validate_bearer_token.return_value = True self.validator.introspect_token.return_value = {} self.endpoint = IntrospectEndpoint(self.validator) self.uri = 'should_not_matter' self.headers = { 'Content-Type': 'application/x-www-form-urlencoded', } self.resp_h = { 'Cache-Control': 'no-store', 'Content-Type': 'application/json', 'Pragma': 'no-cache' } self.resp_b = {"active": True}
def setUp(self): self.validator = MagicMock(wraps=RequestValidator()) self.validator.client_authentication_required.return_value = True self.validator.authenticate_client.return_value = True self.validator.validate_bearer_token.return_value = True self.validator.introspect_token.return_value = {} self.endpoint = IntrospectEndpoint(self.validator) self.uri = 'should_not_matter' self.headers = { 'Content-Type': 'application/x-www-form-urlencoded', } self.resp_h = { 'Cache-Control': 'no-store', 'Content-Type': 'application/json', 'Pragma': 'no-cache' } self.resp_b = { "active": True }
class IntrospectEndpointTest(TestCase): def setUp(self): self.validator = MagicMock(wraps=RequestValidator()) self.validator.client_authentication_required.return_value = True self.validator.authenticate_client.return_value = True self.validator.validate_bearer_token.return_value = True self.validator.introspect_token.return_value = {} self.endpoint = IntrospectEndpoint(self.validator) self.uri = 'should_not_matter' self.headers = { 'Content-Type': 'application/x-www-form-urlencoded', } self.resp_h = { 'Cache-Control': 'no-store', 'Content-Type': 'application/json', 'Pragma': 'no-cache' } self.resp_b = { "active": True } def test_introspect_token(self): for token_type in ('access_token', 'refresh_token', 'invalid'): body = urlencode([('token', 'foo'), ('token_type_hint', token_type)]) h, b, s = self.endpoint.create_introspect_response(self.uri, headers=self.headers, body=body) self.assertEqual(h, self.resp_h) self.assertEqual(loads(b), self.resp_b) self.assertEqual(s, 200) def test_introspect_token_nohint(self): # don't specify token_type_hint body = urlencode([('token', 'foo')]) h, b, s = self.endpoint.create_introspect_response(self.uri, headers=self.headers, body=body) self.assertEqual(h, self.resp_h) self.assertEqual(loads(b), self.resp_b) self.assertEqual(s, 200) def test_introspect_token_false(self): self.validator.introspect_token.return_value = None body = urlencode([('token', 'foo')]) h, b, s = self.endpoint.create_introspect_response(self.uri, headers=self.headers, body=body) self.assertEqual(h, self.resp_h) self.assertEqual(loads(b), {"active": False}) self.assertEqual(s, 200) def test_introspect_token_claims(self): self.validator.introspect_token.return_value = {"foo": "bar"} body = urlencode([('token', 'foo')]) h, b, s = self.endpoint.create_introspect_response(self.uri, headers=self.headers, body=body) self.assertEqual(h, self.resp_h) self.assertEqual(loads(b), {"active": True, "foo": "bar"}) self.assertEqual(s, 200) def test_introspect_token_claims_spoof_active(self): self.validator.introspect_token.return_value = {"foo": "bar", "active": False} body = urlencode([('token', 'foo')]) h, b, s = self.endpoint.create_introspect_response(self.uri, headers=self.headers, body=body) self.assertEqual(h, self.resp_h) self.assertEqual(loads(b), {"active": True, "foo": "bar"}) self.assertEqual(s, 200) def test_introspect_token_client_authentication_failed(self): self.validator.authenticate_client.return_value = False body = urlencode([('token', 'foo'), ('token_type_hint', 'access_token')]) h, b, s = self.endpoint.create_introspect_response(self.uri, headers=self.headers, body=body) self.assertEqual(h, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store', 'Pragma': 'no-cache', "WWW-Authenticate": 'Bearer, error="invalid_client"' }) self.assertEqual(loads(b)['error'], 'invalid_client') self.assertEqual(s, 401) def test_introspect_token_public_client_authentication(self): self.validator.client_authentication_required.return_value = False self.validator.authenticate_client_id.return_value = True for token_type in ('access_token', 'refresh_token', 'invalid'): body = urlencode([('token', 'foo'), ('token_type_hint', token_type)]) h, b, s = self.endpoint.create_introspect_response(self.uri, headers=self.headers, body=body) self.assertEqual(h, self.resp_h) self.assertEqual(loads(b), self.resp_b) self.assertEqual(s, 200) def test_introspect_token_public_client_authentication_failed(self): self.validator.client_authentication_required.return_value = False self.validator.authenticate_client_id.return_value = False body = urlencode([('token', 'foo'), ('token_type_hint', 'access_token')]) h, b, s = self.endpoint.create_introspect_response(self.uri, headers=self.headers, body=body) self.assertEqual(h, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store', 'Pragma': 'no-cache', "WWW-Authenticate": 'Bearer, error="invalid_client"' }) self.assertEqual(loads(b)['error'], 'invalid_client') self.assertEqual(s, 401) def test_introspect_unsupported_token(self): endpoint = IntrospectEndpoint(self.validator, supported_token_types=['access_token']) body = urlencode([('token', 'foo'), ('token_type_hint', 'refresh_token')]) h, b, s = endpoint.create_introspect_response(self.uri, headers=self.headers, body=body) self.assertEqual(h, self.resp_h) self.assertEqual(loads(b)['error'], 'unsupported_token_type') self.assertEqual(s, 400) h, b, s = endpoint.create_introspect_response(self.uri, headers=self.headers, body='') self.assertEqual(h, self.resp_h) self.assertEqual(loads(b)['error'], 'invalid_request') self.assertEqual(s, 400)
class IntrospectEndpointTest(TestCase): def setUp(self): self.validator = MagicMock(wraps=RequestValidator()) self.validator.client_authentication_required.return_value = True self.validator.authenticate_client.return_value = True self.validator.validate_bearer_token.return_value = True self.validator.introspect_token.return_value = {} self.endpoint = IntrospectEndpoint(self.validator) self.uri = 'should_not_matter' self.headers = { 'Content-Type': 'application/x-www-form-urlencoded', } self.resp_h = { 'Cache-Control': 'no-store', 'Content-Type': 'application/json', 'Pragma': 'no-cache' } self.resp_b = {"active": True} def test_introspect_token(self): for token_type in ('access_token', 'refresh_token', 'invalid'): body = urlencode([('token', 'foo'), ('token_type_hint', token_type)]) h, b, s = self.endpoint.create_introspect_response( self.uri, headers=self.headers, body=body) self.assertEqual(h, self.resp_h) self.assertEqual(loads(b), self.resp_b) self.assertEqual(s, 200) def test_introspect_token_nohint(self): # don't specify token_type_hint body = urlencode([('token', 'foo')]) h, b, s = self.endpoint.create_introspect_response( self.uri, headers=self.headers, body=body) self.assertEqual(h, self.resp_h) self.assertEqual(loads(b), self.resp_b) self.assertEqual(s, 200) def test_introspect_token_false(self): self.validator.introspect_token.return_value = None body = urlencode([('token', 'foo')]) h, b, s = self.endpoint.create_introspect_response( self.uri, headers=self.headers, body=body) self.assertEqual(h, self.resp_h) self.assertEqual(loads(b), {"active": False}) self.assertEqual(s, 200) def test_introspect_token_claims(self): self.validator.introspect_token.return_value = {"foo": "bar"} body = urlencode([('token', 'foo')]) h, b, s = self.endpoint.create_introspect_response( self.uri, headers=self.headers, body=body) self.assertEqual(h, self.resp_h) self.assertEqual(loads(b), {"active": True, "foo": "bar"}) self.assertEqual(s, 200) def test_introspect_token_claims_spoof_active(self): self.validator.introspect_token.return_value = { "foo": "bar", "active": False } body = urlencode([('token', 'foo')]) h, b, s = self.endpoint.create_introspect_response( self.uri, headers=self.headers, body=body) self.assertEqual(h, self.resp_h) self.assertEqual(loads(b), {"active": True, "foo": "bar"}) self.assertEqual(s, 200) def test_introspect_token_client_authentication_failed(self): self.validator.authenticate_client.return_value = False body = urlencode([('token', 'foo'), ('token_type_hint', 'access_token')]) h, b, s = self.endpoint.create_introspect_response( self.uri, headers=self.headers, body=body) self.assertEqual( h, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store', 'Pragma': 'no-cache', "WWW-Authenticate": 'Bearer, error="invalid_client"' }) self.assertEqual(loads(b)['error'], 'invalid_client') self.assertEqual(s, 401) def test_introspect_token_public_client_authentication(self): self.validator.client_authentication_required.return_value = False self.validator.authenticate_client_id.return_value = True for token_type in ('access_token', 'refresh_token', 'invalid'): body = urlencode([('token', 'foo'), ('token_type_hint', token_type)]) h, b, s = self.endpoint.create_introspect_response( self.uri, headers=self.headers, body=body) self.assertEqual(h, self.resp_h) self.assertEqual(loads(b), self.resp_b) self.assertEqual(s, 200) def test_introspect_token_public_client_authentication_failed(self): self.validator.client_authentication_required.return_value = False self.validator.authenticate_client_id.return_value = False body = urlencode([('token', 'foo'), ('token_type_hint', 'access_token')]) h, b, s = self.endpoint.create_introspect_response( self.uri, headers=self.headers, body=body) self.assertEqual( h, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store', 'Pragma': 'no-cache', "WWW-Authenticate": 'Bearer, error="invalid_client"' }) self.assertEqual(loads(b)['error'], 'invalid_client') self.assertEqual(s, 401) def test_introspect_unsupported_token(self): endpoint = IntrospectEndpoint(self.validator, supported_token_types=['access_token']) body = urlencode([('token', 'foo'), ('token_type_hint', 'refresh_token')]) h, b, s = endpoint.create_introspect_response(self.uri, headers=self.headers, body=body) self.assertEqual(h, self.resp_h) self.assertEqual(loads(b)['error'], 'unsupported_token_type') self.assertEqual(s, 400) h, b, s = endpoint.create_introspect_response(self.uri, headers=self.headers, body='') self.assertEqual(h, self.resp_h) self.assertEqual(loads(b)['error'], 'invalid_request') self.assertEqual(s, 400) def test_introspect_invalid_request_method(self): endpoint = IntrospectEndpoint(self.validator, supported_token_types=['access_token']) test_methods = ['GET', 'pUt', 'dEleTe', 'paTcH'] test_methods = test_methods + [x.lower() for x in test_methods ] + [x.upper() for x in test_methods] for method in test_methods: body = urlencode([('token', 'foo'), ('token_type_hint', 'refresh_token')]) h, b, s = endpoint.create_introspect_response(self.uri, http_method=method, headers=self.headers, body=body) self.assertEqual(h, self.resp_h) self.assertEqual(loads(b)['error'], 'invalid_request') self.assertIn('Unsupported request method', loads(b)['error_description']) self.assertEqual(s, 400) def test_introspect_bad_post_request(self): endpoint = IntrospectEndpoint(self.validator, supported_token_types=['access_token']) for param in ['token', 'secret', 'code', 'foo']: uri = 'http://some.endpoint?' + urlencode([(param, 'secret')]) body = urlencode([('token', 'foo'), ('token_type_hint', 'access_token')]) h, b, s = endpoint.create_introspect_response(uri, headers=self.headers, body=body) self.assertEqual(h, self.resp_h) self.assertEqual(loads(b)['error'], 'invalid_request') self.assertIn('query parameters are not allowed', loads(b)['error_description']) self.assertEqual(s, 400)
class IntrospectEndpointTest(TestCase): def setUp(self): self.validator = MagicMock(wraps=RequestValidator()) self.validator.client_authentication_required.return_value = True self.validator.authenticate_client.return_value = True self.validator.validate_bearer_token.return_value = True self.validator.introspect_token.return_value = {} self.endpoint = IntrospectEndpoint(self.validator) self.uri = 'should_not_matter' self.headers = { 'Content-Type': 'application/x-www-form-urlencoded', } self.resp_h = { 'Cache-Control': 'no-store', 'Content-Type': 'application/json', 'Pragma': 'no-cache' } self.resp_b = { "active": True } def test_introspect_token(self): for token_type in ('access_token', 'refresh_token', 'invalid'): body = urlencode([('token', 'foo'), ('token_type_hint', token_type)]) h, b, s = self.endpoint.create_introspect_response(self.uri, headers=self.headers, body=body) self.assertEqual(h, self.resp_h) self.assertEqual(loads(b), self.resp_b) self.assertEqual(s, 200) def test_introspect_token_nohint(self): # don't specify token_type_hint body = urlencode([('token', 'foo')]) h, b, s = self.endpoint.create_introspect_response(self.uri, headers=self.headers, body=body) self.assertEqual(h, self.resp_h) self.assertEqual(loads(b), self.resp_b) self.assertEqual(s, 200) def test_introspect_token_false(self): self.validator.introspect_token.return_value = None body = urlencode([('token', 'foo')]) h, b, s = self.endpoint.create_introspect_response(self.uri, headers=self.headers, body=body) self.assertEqual(h, self.resp_h) self.assertEqual(loads(b), {"active": False}) self.assertEqual(s, 200) def test_introspect_token_claims(self): self.validator.introspect_token.return_value = {"foo": "bar"} body = urlencode([('token', 'foo')]) h, b, s = self.endpoint.create_introspect_response(self.uri, headers=self.headers, body=body) self.assertEqual(h, self.resp_h) self.assertEqual(loads(b), {"active": True, "foo": "bar"}) self.assertEqual(s, 200) def test_introspect_token_claims_spoof_active(self): self.validator.introspect_token.return_value = {"foo": "bar", "active": False} body = urlencode([('token', 'foo')]) h, b, s = self.endpoint.create_introspect_response(self.uri, headers=self.headers, body=body) self.assertEqual(h, self.resp_h) self.assertEqual(loads(b), {"active": True, "foo": "bar"}) self.assertEqual(s, 200) def test_introspect_token_client_authentication_failed(self): self.validator.authenticate_client.return_value = False body = urlencode([('token', 'foo'), ('token_type_hint', 'access_token')]) h, b, s = self.endpoint.create_introspect_response(self.uri, headers=self.headers, body=body) self.assertEqual(h, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store', 'Pragma': 'no-cache', "WWW-Authenticate": 'Bearer, error="invalid_client"' }) self.assertEqual(loads(b)['error'], 'invalid_client') self.assertEqual(s, 401) def test_introspect_token_public_client_authentication(self): self.validator.client_authentication_required.return_value = False self.validator.authenticate_client_id.return_value = True for token_type in ('access_token', 'refresh_token', 'invalid'): body = urlencode([('token', 'foo'), ('token_type_hint', token_type)]) h, b, s = self.endpoint.create_introspect_response(self.uri, headers=self.headers, body=body) self.assertEqual(h, self.resp_h) self.assertEqual(loads(b), self.resp_b) self.assertEqual(s, 200) def test_introspect_token_public_client_authentication_failed(self): self.validator.client_authentication_required.return_value = False self.validator.authenticate_client_id.return_value = False body = urlencode([('token', 'foo'), ('token_type_hint', 'access_token')]) h, b, s = self.endpoint.create_introspect_response(self.uri, headers=self.headers, body=body) self.assertEqual(h, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store', 'Pragma': 'no-cache', "WWW-Authenticate": 'Bearer, error="invalid_client"' }) self.assertEqual(loads(b)['error'], 'invalid_client') self.assertEqual(s, 401) def test_introspect_unsupported_token(self): endpoint = IntrospectEndpoint(self.validator, supported_token_types=['access_token']) body = urlencode([('token', 'foo'), ('token_type_hint', 'refresh_token')]) h, b, s = endpoint.create_introspect_response(self.uri, headers=self.headers, body=body) self.assertEqual(h, self.resp_h) self.assertEqual(loads(b)['error'], 'unsupported_token_type') self.assertEqual(s, 400) h, b, s = endpoint.create_introspect_response(self.uri, headers=self.headers, body='') self.assertEqual(h, self.resp_h) self.assertEqual(loads(b)['error'], 'invalid_request') self.assertEqual(s, 400)