rohe / oictest

OAuth2 and OpenID Connect test tools
Other
39 stars 21 forks source link

set and return cookies for interactions #17

Closed theloi closed 10 years ago

theloi commented 10 years ago

I trie to find the piece of code where cookie handling for interactios could be done. The problem I am having is that the login page of the test server does cross-site-request-forgery (csrf) detection via a cookie and other means.

I found various locatios in the code where a cookiejar is kept but somehow this does not seem to work for interactions.

Same issue with Http-Refer header BTW.

Maybe someone can point me to the right spot so I can try implementing it or help me otherwise.

rohe commented 10 years ago

31 aug 2014 kl. 14:13 skrev theloi notifications@github.com:

I trie to find the piece of code where cookie handling for interactios could be done. The problem I am having is that the login page of the test server does cross-site-request-forgery (csrf) detection via a cookie and other means.

I found various locates in the code where a cookiejar is kept but somehow this does not seem to work for interactions.

oictest keeps 3 cookie jars. I started off with one but that was not working, so now I have 3.

They are initiated in src/rrtest/tool.py (line 42-44) and switching between the different jar are done in the same file.

So, what you may have is that the cookies returned ends up in the ’wrong’ jar.

Same issue with Http-Refer header BTW.

An example please.

Maybe someone can point me to the right spot so I can try implementing it or help me otherwise.

If you have a live system (an OP) I can run against where I can see the problem. Then I’d be happy to help.

I can also try to help if you rovide me with the necessary information, like the responses and when they occur.

— Roland

”Being able to think like a child is an important attribute of being an adult” - Eddie Izzard