Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix RSA8c: check authUrl content expectations #474

Merged
merged 6 commits into from
Sep 13, 2016
Merged

Fix RSA8c: check authUrl content expectations #474

merged 6 commits into from
Sep 13, 2016

Conversation

ricardopereira
Copy link
Contributor

@ricardopereira
Copy link
Contributor Author

Not passing: the client is adding additional parameters in the authUrl request: "http://echo.ably.io?ttl=3600.000000&capability=%7B%22*%22:%5B%22*%22%5D%7D&timestamp=1472469020.153623&type=text&body=cg2DSA.DLoyZdazjYF6PY-uDX5fOBMuDfcekJzouLobgEVfJWLVtpVGIaLWGji8JxxAmujqu5eKW-jOCNeWFpC8Da3rQnCJsbfZecYshiVjQLp8se0EIKV8Rn7xt6jb_wjFkeBn6&format=msgpack"

@ricardopereira
Copy link
Contributor Author

ricardopereira commented Aug 29, 2016

Wrong assumption

Not passing: the client is adding additional parameters in the authUrl request: "http://echo.ably.io?ttl=3600.000000&capability=%7B%22*%22:%5B%22*%22%5D%7D&timestamp=1472469020.153623&type=text&body=cg2DSA.DLoyZdazjYF6PY-uDX5fOBMuDfcekJzouLobgEVfJWLVtpVGIaLWGji8JxxAmujqu5eKW-jOCNeWFpC8Da3rQnCJsbfZecYshiVjQLp8se0EIKV8Rn7xt6jb_wjFkeBn6&format=msgpack"

but TO3j9 says that authParams should include additional params to any request made by the library to the authUrl. So, the client shouldn't be adding the TokenParams like ttl, capability, etc. to the authUrl request, right?

expect(tokenDetails?.capability) == testTokenDetails.capability
expect(tokenDetails?.issued).toNot(beNil())
expect(tokenDetails?.expires).toNot(beNil())
if let issued = tokenDetails?.issued, let testIssued = testTokenDetails.issued {
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pending because tokenDetails.issued is nil and tokenDetails.expires is nil.

But jsonTokenDetails.toUTF8String is "http://echo.ably.io?ttl=3600.000000&capability=%7B%22*%22:%5B%22*%22%5D%7D&timestamp=1472479389.001963&type=json&body=%7B%22expires%22:%221472482988000%22,%22capability%22:%22%7B%5C%22*%5C%22:%5B%5C%22*%5C%22%5D%7D%22,%22token%22:%22WKZpMg.Dcg4-NM2v5eYV5v8bmkTRxv4oe3nmp7qmQ4DA-5lXij4tcizw7uIex0vMrOtNUqRcSZhGR9z9d5H60dZBayVTpcABAO80d4K9_F6I-IgpMryU7md31s9IbmPkrZvuU7Rs%22,%22issued%22:%221472479388000%22%7D&format=msgpack"

Both issued and expires have values and echo.ably.io is working fine.

curl -X "GET" "http://echo.ably.io/?type=json&body=%7B%22expires%22:%221472482988000%22,%22capability%22:%22%7B%5C%22*%5C%22:%5B%5C%22*%5C%22%5D%7D%22,%22token%22:%22WKZpMg.Dcg4-NM2v5eYV5v8bmkTRxv4oe3nmp7qmQ4DA-5lXij4tcizw7uIex0vMrOtNUqRcSZhGR9z9d5H60dZBayVTpcABAO80d4K9_F6I-IgpMryU7md31s9IbmPkrZvuU7Rs%22,%22issued%22:%221472479388000%22%7D"

cURL returns:

{"expires":"1472482988000","capability":"{\"*\":[\"*\"]}","token":"WKZpMg.Dcg4-NM2v5eYV5v8bmkTRxv4oe3nmp7qmQ4DA-5lXij4tcizw7uIex0vMrOtNUqRcSZhGR9z9d5H60dZBayVTpcABAO80d4K9_F6I-IgpMryU7md31s9IbmPkrZvuU7Rs","issued":"1472479388000"}

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not pending anymore, right?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, fixed da08ea9

@ricardopereira
Copy link
Contributor Author

I can squash this after review.

var tokenRequest: ARTTokenRequest?
waitUntil(timeout: testTimeout) { done in
// Sandbox and valid TokenRequest
ARTRest(options: AblyTests.commonAppSetup()).auth.createTokenRequest(nil, options: nil, callback: { newTokenRequest, error in
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Shouldn't we add something to the token request (capability, etc.) and then check in the retrieved TokenDetails that it matches? As is, the library could be ignoring the token request from authUrl and we wouldn't notice.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done 48025f0 👍

@tcard
Copy link
Contributor

tcard commented Aug 31, 2016

@ricardopereira PTAL

@ricardopereira
Copy link
Contributor Author

@tcard Looks good 👍

@ricardopereira
Copy link
Contributor Author

Should I squash?

@ricardopereira
Copy link
Contributor Author

@tcard I don't know if you notice but the authUrl request has more url params than it should.

ttl=3600.000000&capability ... ⬇️

http://echo.ably.io?ttl=3600.000000&capability=%7B%22*%22:%5B%22*%22%5D%7D&timestamp=1472479389.001963&type=json&body=%7B%22expires%22:%221472482988000%22,%22capability%22:%22%7B%5C%22*%5C%22:%5B%5C%22*%5C%22%5D%7D%22,%22token%22:%22WKZpMg.Dcg4-NM2v5eYV5v8bmkTRxv4oe3nmp7qmQ4DA-5lXij4tcizw7uIex0vMrOtNUqRcSZhGR9z9d5H60dZBayVTpcABAO80d4K9_F6I-IgpMryU7md31s9IbmPkrZvuU7Rs%22,%22issued%22:%221472479388000%22%7D&format=msgpack

@tcard
Copy link
Contributor

tcard commented Aug 31, 2016

@ricardopereira
Copy link
Contributor Author

@tcard Yes, sorry.

@ricardopereira ricardopereira force-pushed the fix-rsa8c branch 2 times, most recently from 8bbebff to 8d0e087 Compare August 31, 2016 16:36
@mattheworiordan
Copy link
Member

👍

ricardopereira and others added 6 commits September 7, 2016 18:57
 - NSJSONSerialization does the correct number deserialization. No need
to explicitly check the NSNumber type.
TokenRequest: it first should use the `authUrl` and then it should
request a token as usual
@tcard tcard merged commit 9b3bf66 into master Sep 13, 2016
@tcard tcard deleted the fix-rsa8c branch September 13, 2016 23:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

Successfully merging this pull request may close these issues.

3 participants