mirror of
https://github.com/nais/wonderwall.git
synced 2026-05-17 13:56:35 +00:00
c0138f4b49
One of the changes in OAuth 2.1 addresses attacks with refresh token replays by recommending the use of one-time use tokens. A refresh token is thus rotated and invalid after exactly one use, returning a new token for each successful grant. Any further attempts must thus use the most recently acquired refresh token. Reusing a refresh token may also cause the authorization server to invalidate the current active refresh token, requiring a refresh authorization grant to be reacquired for further refresh token usage. The use of locks prevents multiple refresh grant attempts for a given session from happening across concurrent requests.
41 lines
731 B
Go
41 lines
731 B
Go
package session_test
|
|
|
|
import (
|
|
"context"
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/alicebob/miniredis/v2"
|
|
"github.com/go-redis/redis/v8"
|
|
"github.com/stretchr/testify/assert"
|
|
|
|
"github.com/nais/wonderwall/pkg/session"
|
|
)
|
|
|
|
func TestRedisLock(t *testing.T) {
|
|
s, err := miniredis.Run()
|
|
if err != nil {
|
|
panic(err)
|
|
}
|
|
defer s.Close()
|
|
|
|
client := redis.NewClient(&redis.Options{
|
|
Network: "tcp",
|
|
Addr: s.Addr(),
|
|
})
|
|
|
|
key := "some-key"
|
|
ctx := context.Background()
|
|
lock := session.NewRedisLock(client, key)
|
|
|
|
err = lock.Acquire(ctx, time.Minute)
|
|
assert.NoError(t, err)
|
|
|
|
err = lock.Acquire(ctx, time.Minute)
|
|
assert.Error(t, err)
|
|
assert.ErrorIs(t, err, session.AcquireLockError)
|
|
|
|
err = lock.Release(ctx)
|
|
assert.NoError(t, err)
|
|
}
|