From 36b25aa1c4863cc70c74fd783fb54ba44a3a128e Mon Sep 17 00:00:00 2001
From: Milo Winningham <milo@winningham.net>
Date: Fri, 21 Jun 2019 23:29:05 -0700
Subject: Add test for cookie being modified by rotation
---
actionpack/test/dispatch/cookies_test.rb | 13 +++++++++++++
1 file changed, 13 insertions(+)
diff --git a/actionpack/test/dispatch/cookies_test.rb b/actionpack/test/dispatch/cookies_test.rb
index d129fa717d..e4d4792de6 100644
--- a/actionpack/test/dispatch/cookies_test.rb
+++ b/actionpack/test/dispatch/cookies_test.rb
@@ -893,6 +893,19 @@ class CookiesTest < ActionController::TestCase
assert_equal 45, encryptor.decrypt_and_verify(@response.cookies["foo"])
end
+ def test_cookie_with_hash_value_not_modified_by_rotation
+ @request.env["action_dispatch.signed_cookie_digest"] = "SHA256"
+ @request.env["action_dispatch.cookies_rotations"].rotate :signed, digest: "SHA1"
+
+ key_generator = @request.env["action_dispatch.key_generator"]
+ old_secret = key_generator.generate_key(@request.env["action_dispatch.signed_cookie_salt"])
+ old_value = ActiveSupport::MessageVerifier.new(old_secret).generate(bar: "baz")
+
+ @request.headers["Cookie"] = "foo=#{old_value}"
+ get :get_signed_cookie
+ assert_equal({ bar: "baz" }, @controller.send(:cookies).signed[:foo])
+ end
+
def test_cookie_with_all_domain_option
get :set_cookie_with_domain
assert_response :success
--
cgit v1.2.3