test: harden security coverage for body cap, CSRF, and JWKS (#31/#32/#36)#46
Merged
Merged
Conversation
) The v0.7 security fixes shipped with uneven test coverage. This adds self-contained tests (no network, no crypto deps) for the three lighter areas, hardening the public-launch gate. #36 (RS256 / JWKS) — a fixed RSA-2048 test keypair signs tokens in pure Python and _get_public_key is patched to return its public half, so signature verification is exercised deterministically instead of fetching Google's live JWKS. Covers: valid signature accepted; tampered payload rejected; alg=none downgrade rejected; alg=HS256 rejected; missing kid; malformed token; wrong key; and the _claims_from_id_token path actually running verification. #32 (CSRF / same-origin) — previously untested. Adds full branch coverage of _same_origin (matching/mismatched Origin, Referer fallback, no headers, no base_url, Origin-over-Referer precedence, trailing-slash) plus live-server enforcement: cookie POSTs are blocked cross-origin / origin-less and allowed same-origin, while Bearer /v1/usage stays exempt. #31 (body cap) — adds _body boundary coverage: at-limit allowed, over-limit raises _BodyTooLarge, missing Content-Length is empty, and the 1 MiB default. Tests only; no behavior change. Full suite: 142 passed (was 118). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The v0.7 security hardening (PR #42) shipped with uneven test coverage. Per the launch-gate follow-up,
#31(body cap),#32(CSRF/same-origin), and#36(JWKS) had lighter coverage than ideal —#32had none, and the only#36test reached out to Google's live JWKS endpoint (flaky offline). This PR closes those gaps with self-contained tests — no network, no crypto dependencies — to harden the public-launch gate.Tests only; no behavior change.
What
#36 — RS256 / JWKS signature verification (
TestRS256Verification)A fixed RSA-2048 test keypair signs tokens in pure Python (EMSA-PKCS1-v1_5 / SHA-256), and
_get_public_keyis patched to return its public half — so the hand-rolled verifier is exercised deterministically. Covers:alg=nonedowngrade rejectedalg=HS256rejectedkid, malformed token, wrong key_claims_from_id_tokenactually running verification on the real (non-hdr) path#32 — CSRF / same-origin (
TestSameOriginunit +TestCSRFEnforcementintegration)Previously untested. Full branch coverage of
_same_origin(matching/mismatchedOrigin,Refererfallback, no headers, nobase_url,Origin-over-Refererprecedence, trailing-slash normalization), plus live-server enforcement: cookie-authenticated POSTs are blocked cross-origin and origin-less, allowed same-origin, while Bearer/v1/usagestays exempt.#31 — body cap (
TestBodyCap)_bodyboundary coverage: at-limit allowed, over-limit raises_BodyTooLarge, missingContent-Lengthis empty, and the 1 MiB default constant.Verification
Full suite: 142 passed (was 118) locally on Windows / Python 3.14.
🤖 Generated with Claude Code