test414: verify secure cookie domain overlay

diff --git a/tests/data/Makefile.inc b/tests/data/Makefile.inc
index 5c4b113e6c6373c9792908dc8e7656a7cb8faa00..bd444e5f7600b4968d59c3f12cb987ea6c580694 100644 (file)
--- a/tests/data/Makefile.inc
+++ b/tests/data/Makefile.inc
@@ -67,7 +67,7 @@ test380 test381 test383 test384 test385 test386 \
 test392 test393 test394 test395 test396 test397 test398 \
 \
 test400 test401 test402 test403 test404 test405 test406 test407 test408 \
-test409 test410 test411 test412 test413 \
+test409 test410 test411 test412 test413 test414 \
 \
 test430 test431 test432 test433 test434 test435 test436 \
 \

diff --git a/tests/data/test414 b/tests/data/test414
new file mode 100644 (file)
index 0000000..a0e1434
--- /dev/null
+++ b/tests/data/test414
@@ -0,0 +1,83 @@
+<testcase>
+<info>
+<keywords>
+HTTP
+cookies
+</keywords>
+</info>
+
+#
+# Server-side
+<reply>
+<data nocheck="yes">
+HTTP/1.1 301 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Content-Length: 6
+Set-Cookie: SESSIONID=originaltoken; secure
+Set-Cookie: second=originaltoken; secure; path=/a
+Location: http://attack.invalid:%HTTPPORT/a/b/%TESTNUMBER0002
+
+-foo-
+</data>
+
+<data2>
+HTTP/1.1 301 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Content-Length: 6
+Set-Cookie: SESSIONID=hacker; domain=attack.invalid;
+Set-Cookie: second=replacement; path=/a/b
+Location: https://attack.invalid:%HTTPSPORT/a/b/%TESTNUMBER0003
+
+-foo-
+</data2>
+
+<data3>
+HTTP/1.1 200 OK
+Date: Tue, 09 Nov 2010 14:49:00 GMT
+Server: test-server/fake
+Content-Length: 6
+
+-foo-
+</data3>
+</reply>
+
+#
+# Client-side
+<client>
+<server>
+http
+https
+</server>
+<name>
+HTTPS sec-cookie, HTTP redirect, same name cookie, redirect back
+</name>
+<command>
+https://attack.invalid:%HTTPSPORT/a/b/%TESTNUMBER -k -c log/cookie%TESTNUMBER --resolve attack.invalid:%HTTPSPORT:%HOSTIP --resolve attack.invalid:%HTTPPORT:%HOSTIP -L
+</command>
+</client>
+
+#
+# Verify data after the test has been "shot"
+<verify>
+<protocol>
+GET /a/b/%TESTNUMBER HTTP/1.1\r
+Host: attack.invalid:%HTTPSPORT\r
+User-Agent: curl/%VERSION\r
+Accept: */*\r
+\r
+GET /a/b/%TESTNUMBER0002 HTTP/1.1\r
+Host: attack.invalid:%HTTPPORT\r
+User-Agent: curl/%VERSION\r
+Accept: */*\r
+\r
+GET /a/b/%TESTNUMBER0003 HTTP/1.1\r
+Host: attack.invalid:%HTTPSPORT\r
+User-Agent: curl/%VERSION\r
+Accept: */*\r
+Cookie: SESSIONID=originaltoken; second=originaltoken\r
+\r
+</protocol>
+</verify>
+</testcase>