Improve tests

hzalaz · hzalaz · commit 217af05d16d6 · 2016-08-23T22:36:49.000-03:00
diff --git a/src/test/java/com/auth0/jwt/JWTVerifierRsa256Test.java b/src/test/java/com/auth0/jwt/JWTVerifierRsa256Test.java
@@ -1,9 +1,16 @@
 package com.auth0.jwt;
 
+import com.auth0.jwt.pem.X509CertUtils;
+import org.apache.commons.codec.binary.Base64;
 import org.junit.Test;
 
+import java.io.File;
+import java.nio.file.Files;
 import java.security.PublicKey;
 import java.security.SignatureException;
+import java.security.cert.X509Certificate;
+import java.util.HashMap;
+import java.util.Map;
 
 import static com.auth0.jwt.pem.PemReader.readPublicKey;
 import static junit.framework.TestCase.assertNotNull;
@@ -13,10 +20,10 @@
  */
 public class JWTVerifierRsa256Test {
 
-    public final static String RESOURCES_DIR = "src/test/resources/auth0-pem/";
-    public final static String MISMATCHED_RESOURCES_DIR = "src/test/resources/test-pem/";
-    public final static String PUBLIC_KEY_PEM_FILENAME = "key.pem";
-    public final static String MISMATCHED_PUBLIC_KEY_PEM_FILENAME = "test-auth0.pem";
+    private final static String RESOURCES_DIR = "src/test/resources/auth0-pem/";
+    private final static String MISMATCHED_RESOURCES_DIR = "src/test/resources/test-pem/";
+    private final static String PUBLIC_KEY_PEM_FILENAME = "key.pem";
+    private final static String MISMATCHED_PUBLIC_KEY_PEM_FILENAME = "test-auth0.pem";
 
 
 
@@ -67,7 +74,7 @@ public void shouldFailOnInvalidJWTTokenSignature() throws Exception {
 
     /**
      * Here we modify the payload section on an otherwise legal JWT Token and check verification using the correct Public Key and
-     * unaltered JWT signnature (which now doesn't match the payload) fails
+     * unaltered JWT signature (which now doesn't match the payload) fails
      */
     @Test(expected = SignatureException.class)
     public void shouldFailOnInvalidJWTTokenPayload() throws Exception {
@@ -81,5 +88,19 @@ public void shouldFailOnInvalidJWTTokenPayload() throws Exception {
         new JWTVerifier(publicKey, "audience").verifySignature(token.split("\\."), Algorithm.RS256);
     }
 
+    @Test(expected = IllegalStateException.class)
+    public void shouldFailWithJwtThaHasTamperedAlgorithm() throws Exception {
+        final File file = new File(RESOURCES_DIR + PUBLIC_KEY_PEM_FILENAME);
+        final byte[] data = Files.readAllBytes(file.toPath());
+        JWTSigner signer = new JWTSigner(data);
+        Map<String, Object> claims = new HashMap<>();
+        claims.put("sub", "userid");
+        JWTSigner.Options options = new JWTSigner.Options();
+        options.setAlgorithm(Algorithm.HS256);
+        String jwt = signer.sign(claims, options);
+        new JWTVerifier(data).verify(jwt);
+        final PublicKey publicKey = readPublicKey(RESOURCES_DIR + PUBLIC_KEY_PEM_FILENAME);
+        new JWTVerifier(publicKey).verify(jwt);
+    }
 }
 
diff --git a/src/test/java/com/auth0/jwt/JWTVerifierTest.java b/src/test/java/com/auth0/jwt/JWTVerifierTest.java
@@ -103,6 +103,15 @@ public void shouldVerifySignature() throws Exception {
                 .verifySignature(jws.split("\\."), Algorithm.HS256);
     }
 
+    @Test
+    public void shouldFailWithJwtThaHasTamperedAlgorithm() throws Exception {
+        expectedException.expect(IllegalStateException.class);
+        String tamperedAlg = "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJpc3MiOiJqb2UiLCJleHAiOjEzMDA4MTkzODAsImh0dHA6Ly9leGFtcGxlLmNvbS9pc19yb290Ijp0cnVlfQ.QRsN2SlYJ3EEn7P9dnZGsq9tjyv3giOWzZJzhy67zZs";
+        byte[] secret = decoder.decode("AyM1SysPpbyDfgZld3umj1qzKObwVMkoqQ-EstJQLr_T-1qS0gZH75aKtMN3Yj0iPS4hcgUuTwjAzZr1Z9CAow");
+        JWTVerifier verifier = new JWTVerifier(secret);
+        verifier.verify(tamperedAlg);
+    }
+
     @Test
     public void shouldFailWhenExpired1SecondAgo() throws Exception {
         expectedException.expect(JWTExpiredException.class);
