httpdis 0.6.30__tar.gz → 0.6.32__tar.gz

{httpdis-0.6.30/httpdis.egg-info → httpdis-0.6.32}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: httpdis
-Version: 0.6.30
+Version: 0.6.32
 Summary: httpdis
 Home-page: https://github.com/decryptus/httpdis
 Author: Adrien Delle Cave
@@ -237,7 +237,10 @@ Routes, authentication, response formats, route/global body-limit fallback and
 lifecycle callback arguments remain compatible. Handler classes are now bound
 through a subclass rather than modified in place. Repeated `stop()` calls no
 longer repeat shutdown hooks. Startup/serving failures close the created socket,
-and shutdown-hook failures still trigger transport cleanup.
+and shutdown-hook failures do not skip subsequent hooks or transport cleanup.
+Shutdown attempts every registered cleanup and re-raises the first failure with
+its traceback, even if later hooks or transport cleanup also fail. Reentrant
+and repeated `stop()` calls do not run the hooks again.
 
 The default schema is defined once in `httpdis.config`. Both historical
 `DEFAULT_OPTIONS` import paths remain independent dictionaries with the same
@@ -462,9 +465,43 @@ is accepted; incompatible databases are refused, never silently reset. JSON
 records are bounded to 64 KiB and support the existing four namespaces. Redis
 and automatic schema migrations are not supplied by this adapter.
 
-**Browser integration is still pending:** this backend does not expose login/logout
-routes, set cookies, configure HTTPS/CORS, enforce request Origin or provide TOTP.
-The caller must mark every cookie-authenticated mutation for CSRF validation; do
-not expose a cookie provider without the complete browser transport protections.
-Only the token-only provider is supplied in this step. Session/login APIs are
-neutral services ready for the subsequent transport integration.
+### Browser session transport
+
+`httpdis.auth_browser.BrowserAuthProvider(service, origin, cookie_prefix='httpdis')`
+adds an opt-in cookie adapter over the same `LocalAuthService`. The daemon supplies
+the service, backend, public origin and lifecycle; HTTPdis installs no routes.
+`BearerAuthProvider` remains token-only and legacy Basic behavior is unchanged.
+
+The provider's `login(AuthenticationRequest, principal, password)` returns the
+existing redacted session grant. Send `provider.cookie(grant.secret, max_age)` as
+`Set-Cookie`, and return only the CSRF value and identity to browser JavaScript.
+Do not return the session secret in JSON or store it in browser JavaScript storage.
+Use `provider.logout(request)` before sending `provider.expired_cookie()`.
+Login rotates any previous cookie session, and logout requires the current CSRF.
+The service already enforces password hashing, login limits, idle/absolute expiry,
+account revision, disable and persistent revocation.
+
+HTTPS cookies use `__Host-<prefix>-session`, `Secure`, `HttpOnly`, `SameSite=Strict`,
+`Path=/`, a bounded `Max-Age`, and no Domain attribute. HTTP is accepted only for
+literal `127.0.0.1` / `::1` development origins, with an unprefixed non-Secure cookie.
+The configured origin must have no path; standard ports are canonicalized.
+Use a dedicated origin: unrelated applications on the same origin share browser
+security boundaries. Behind TLS termination, configure the external HTTPS origin,
+preserve Host, and keep direct backend access private. Forwarded headers are never
+trusted to choose the origin or weaken cookie policy.
+
+Cookie reads require the configured Host and reject foreign Origin/fetch metadata.
+Every cookie mutation requires exact Origin, JSON Content-Type and X-CSRF-Token.
+Login requires the same Origin/JSON checks even before a session exists. Duplicate
+security headers/cookies and mixed Bearer/session credentials are rejected. Explicit
+Bearer clients without browser metadata continue to work without cookies or Origin.
+
+Embedding requirements: serve only fixed public login/assets routes; protect all
+business routes; bound login request bodies; prohibit CORS/preflight in browser
+mode; apply no-store, CSP, frame denial and nosniff headers to errors as well as
+successes; never log credentials, payloads or cookies. `require_browser` is exposed
+for checking public routes before parsing their body. HTTPdis's historical generic
+OPTIONS behavior is unchanged: override it in the embedding browser handler.
+Application scopes, ownership and action confirmation remain application policy.
+This adapter supplies no HTML UI, proxy configuration, TOTP or SSO.
+

{httpdis-0.6.30 → httpdis-0.6.32}/README.md

@@ -190,7 +190,10 @@ Routes, authentication, response formats, route/global body-limit fallback and
 lifecycle callback arguments remain compatible. Handler classes are now bound
 through a subclass rather than modified in place. Repeated `stop()` calls no
 longer repeat shutdown hooks. Startup/serving failures close the created socket,
-and shutdown-hook failures still trigger transport cleanup.
+and shutdown-hook failures do not skip subsequent hooks or transport cleanup.
+Shutdown attempts every registered cleanup and re-raises the first failure with
+its traceback, even if later hooks or transport cleanup also fail. Reentrant
+and repeated `stop()` calls do not run the hooks again.
 
 The default schema is defined once in `httpdis.config`. Both historical
 `DEFAULT_OPTIONS` import paths remain independent dictionaries with the same
@@ -415,9 +418,43 @@ is accepted; incompatible databases are refused, never silently reset. JSON
 records are bounded to 64 KiB and support the existing four namespaces. Redis
 and automatic schema migrations are not supplied by this adapter.
 
-**Browser integration is still pending:** this backend does not expose login/logout
-routes, set cookies, configure HTTPS/CORS, enforce request Origin or provide TOTP.
-The caller must mark every cookie-authenticated mutation for CSRF validation; do
-not expose a cookie provider without the complete browser transport protections.
-Only the token-only provider is supplied in this step. Session/login APIs are
-neutral services ready for the subsequent transport integration.
+### Browser session transport
+
+`httpdis.auth_browser.BrowserAuthProvider(service, origin, cookie_prefix='httpdis')`
+adds an opt-in cookie adapter over the same `LocalAuthService`. The daemon supplies
+the service, backend, public origin and lifecycle; HTTPdis installs no routes.
+`BearerAuthProvider` remains token-only and legacy Basic behavior is unchanged.
+
+The provider's `login(AuthenticationRequest, principal, password)` returns the
+existing redacted session grant. Send `provider.cookie(grant.secret, max_age)` as
+`Set-Cookie`, and return only the CSRF value and identity to browser JavaScript.
+Do not return the session secret in JSON or store it in browser JavaScript storage.
+Use `provider.logout(request)` before sending `provider.expired_cookie()`.
+Login rotates any previous cookie session, and logout requires the current CSRF.
+The service already enforces password hashing, login limits, idle/absolute expiry,
+account revision, disable and persistent revocation.
+
+HTTPS cookies use `__Host-<prefix>-session`, `Secure`, `HttpOnly`, `SameSite=Strict`,
+`Path=/`, a bounded `Max-Age`, and no Domain attribute. HTTP is accepted only for
+literal `127.0.0.1` / `::1` development origins, with an unprefixed non-Secure cookie.
+The configured origin must have no path; standard ports are canonicalized.
+Use a dedicated origin: unrelated applications on the same origin share browser
+security boundaries. Behind TLS termination, configure the external HTTPS origin,
+preserve Host, and keep direct backend access private. Forwarded headers are never
+trusted to choose the origin or weaken cookie policy.
+
+Cookie reads require the configured Host and reject foreign Origin/fetch metadata.
+Every cookie mutation requires exact Origin, JSON Content-Type and X-CSRF-Token.
+Login requires the same Origin/JSON checks even before a session exists. Duplicate
+security headers/cookies and mixed Bearer/session credentials are rejected. Explicit
+Bearer clients without browser metadata continue to work without cookies or Origin.
+
+Embedding requirements: serve only fixed public login/assets routes; protect all
+business routes; bound login request bodies; prohibit CORS/preflight in browser
+mode; apply no-store, CSP, frame denial and nosniff headers to errors as well as
+successes; never log credentials, payloads or cookies. `require_browser` is exposed
+for checking public routes before parsing their body. HTTPdis's historical generic
+OPTIONS behavior is unchanged: override it in the embedding browser handler.
+Application scopes, ownership and action confirmation remain application policy.
+This adapter supplies no HTML UI, proxy configuration, TOTP or SSO.
+

httpdis-0.6.32/RELEASE

@@ -0,0 +1 @@
+0.6.32

httpdis-0.6.32/VERSION

@@ -0,0 +1 @@
+0.6.32

httpdis-0.6.32/httpdis/auth_browser.py

@@ -0,0 +1,153 @@
+# -*- coding: utf-8 -*-
+"""Opt-in browser transport policy over an application-owned LocalAuthService.
+
+No routes, database paths, proxy trust or default backend are installed here.
+The embedding server must expose login/logout, bound JSON bodies, disable CORS
+and serve the configured public HTTPS origin (HTTP is local development only).
+"""
+import re
+from six import string_types
+from six.moves.urllib.parse import urlsplit
+from .authentication import AuthenticationDenied, AuthenticationProvider, AUTH_HEADER_NAMES
+from .auth_backend import BearerAuthProvider
+
+SAFE_METHODS = frozenset(('GET', 'HEAD'))
+MAX_COOKIE_BYTES = 8192
+COOKIE_PREFIX_PATTERN = re.compile(r'^[a-z][a-z0-9-]{0,39}$')
+OPAQUE_PATTERN = re.compile(r'^[A-Za-z0-9_-]{43}$')
+ORIGIN_AUTHORITY_PATTERN = re.compile(r'^(\[[0-9a-fA-F:]+\]|[A-Za-z0-9.\-]+)(?::([0-9]{1,5}))?$')
+LOOPBACK_HOSTS = frozenset(('127.0.0.1', '::1'))
+
+
+def browser_origin(value):
+    """Validate and canonicalize an explicit public origin; never trust Forwarded."""
+    try:
+        if (not isinstance(value, string_types) or not value or len(value) > 2048
+                or any(ord(c) <= 32 or ord(c) >= 127 for c in value)):
+            raise ValueError()
+        parsed = urlsplit(value)
+        if (parsed.scheme not in ('https', 'http') or not parsed.hostname
+                or parsed.username is not None or parsed.password is not None
+                or parsed.path or parsed.query or parsed.fragment or '?' in value or '#' in value
+                or not ORIGIN_AUTHORITY_PATTERN.match(parsed.netloc)
+                or parsed.netloc.endswith(':')):
+            raise ValueError()
+        # Python 2.7/3.5 can turn an out-of-range .port into None. Validate the
+        # literal authority ourselves so supported interpreters agree.
+        authority_match = ORIGIN_AUTHORITY_PATTERN.match(parsed.netloc)
+        port = int(authority_match.group(2)) if authority_match.group(2) is not None else None
+        if port is not None and not 1 <= port <= 65535:
+            raise ValueError()
+        if parsed.scheme == 'http' and parsed.hostname not in LOOPBACK_HOSTS:
+            raise ValueError()
+        host = parsed.hostname.lower()
+        authority = '[%s]' % host if ':' in host else host
+        if port is not None and port != (443 if parsed.scheme == 'https' else 80):
+            authority += ':%s' % port
+        return parsed.scheme + '://' + authority
+    except (ValueError, TypeError):
+        raise ValueError('browser origin must be HTTPS, or HTTP on 127.0.0.1/::1, without a path')
+
+
+class BrowserAuthProvider(AuthenticationProvider):
+    """Cookies for browsers, Bearer for explicit API callers, never fallback.
+
+    Session secrets stay in HttpOnly cookies. The login grant's separate CSRF
+    value must be sent in X-CSRF-Token for every mutation, including logout.
+    Cookie and Bearer credentials cannot be combined in one request.
+    """
+    challenge = 'Bearer'
+
+    def __init__(self, service, origin, cookie_prefix='httpdis'):
+        if (not isinstance(cookie_prefix, string_types)
+                or not COOKIE_PREFIX_PATTERN.match(cookie_prefix)
+                or COOKIE_PREFIX_PATTERN.match(cookie_prefix).end() != len(cookie_prefix)):
+            raise ValueError('invalid cookie prefix')
+        self.service = service
+        self.origin = browser_origin(origin)
+        self.authority = urlsplit(self.origin).netloc
+        self.secure = self.origin.startswith('https://')
+        self.cookie_name = ('__Host-' if self.secure else '') + cookie_prefix + '-session'
+        self.bearer = BearerAuthProvider(service)
+
+    def require_browser(self, request, mutation=False):
+        for name in AUTH_HEADER_NAMES:
+            request.header(name)  # Reject duplicate security headers on public login too.
+        if request.header('host', '').lower() != self.authority:
+            raise AuthenticationDenied()
+        origin = request.header('origin')
+        if origin is not None and origin != self.origin:
+            raise AuthenticationDenied()
+        if request.header('sec-fetch-site') not in (None, 'same-origin', 'none'):
+            raise AuthenticationDenied()
+        if mutation:
+            ctype = request.header('content-type', '').split(';', 1)[0].strip().lower()
+            if origin != self.origin or ctype != 'application/json':
+                raise AuthenticationDenied()
+
+    def session_secret(self, request):
+        cookie = request.header('cookie', '')
+        if not isinstance(cookie, string_types) or len(cookie) > MAX_COOKIE_BYTES:
+            raise AuthenticationDenied()
+        values = []
+        for part in cookie.split(';'):
+            name, sep, value = part.strip().partition('=')
+            if name == self.cookie_name:
+                if not sep:
+                    raise AuthenticationDenied()
+                values.append(value)
+        if not values:
+            return None
+        if len(values) != 1 or not self._opaque(values[0]):
+            raise AuthenticationDenied()
+        return values[0]
+
+    @staticmethod
+    def _opaque(value):
+        return (isinstance(value, string_types) and len(value) == 43
+                and OPAQUE_PATTERN.match(value) is not None)
+
+    def authenticate(self, request):
+        secret = self.session_secret(request)
+        if request.header('authorization') is not None:
+            if secret is not None:
+                raise AuthenticationDenied()
+            if request.header('origin') is not None or request.header('sec-fetch-site') is not None:
+                self.require_browser(request, request.method not in SAFE_METHODS)
+            return self.bearer.authenticate(request)
+        mutation = request.method not in SAFE_METHODS
+        self.require_browser(request, mutation)
+        if secret is None:
+            raise AuthenticationDenied()
+        return self.service.authenticate_session(secret, request.header('x-csrf-token'), mutation)
+
+    def login(self, request, principal, password):
+        self.require_browser(request, mutation=True)
+        if request.method != 'POST' or request.header('authorization') is not None:
+            raise AuthenticationDenied()
+        previous = self.session_secret(request)
+        grant = self.service.login(principal, password, request.peer)
+        # Never adopt a supplied session identifier. Reauthentication rotates it.
+        if previous is not None:
+            try:
+                self.service.logout(previous)
+            except Exception:
+                self.service.logout(grant.secret)
+                raise
+        return grant
+
+    def logout(self, request):
+        if request.method != 'POST' or request.header('authorization') is not None:
+            raise AuthenticationDenied()
+        self.authenticate(request)
+        self.service.logout(self.session_secret(request))
+
+    def cookie(self, secret, max_age):
+        if not self._opaque(secret) or type(max_age) is not int or max_age < 0:
+            raise ValueError('invalid session cookie')
+        return '%s=%s; Path=/; Max-Age=%d; HttpOnly; SameSite=Strict%s' % (
+            self.cookie_name, secret, max_age, '; Secure' if self.secure else '')
+
+    def expired_cookie(self):
+        return '%s=; Path=/; Max-Age=0; HttpOnly; SameSite=Strict%s' % (
+            self.cookie_name, '; Secure' if self.secure else '')

{httpdis-0.6.30 → httpdis-0.6.32}/httpdis/httpdis.py

@@ -56,7 +56,8 @@ from six import (BytesIO,
                  ensure_binary,
                  ensure_text,
                  integer_types,
-                 iteritems)
+                 iteritems,
+                 reraise)
 from six.moves import http_cookies
 from six.moves.urllib import parse as urlparse, request as urlrequest
 from six.moves.BaseHTTPServer import BaseHTTPRequestHandler
@@ -1306,17 +1307,26 @@ class HttpServerContext(object):
             server = self.server
         # Application callbacks may wait for workers. Do not hold the lifecycle
         # lock while they run; the serving thread must be able to finish.
+        cleanups = [(name, cmd.at_stop) for name, cmd in iteritems(self.commands)
+                    if cmd.at_stop]
+        if server:
+            cleanups.extend((('server.kill', server.kill),
+                             ('server.server_close', server.server_close)))
+        first_error = None
         try:
-            for name, cmd in iteritems(self.commands):
-                if cmd.at_stop:
+            for name, cleanup in cleanups:
+                try:
                     LOG.info("at_stop: %r", name)
-                    cmd.at_stop()
+                    cleanup()
+                except BaseException:
+                    if first_error is None:
+                        first_error = sys.exc_info()
+                    LOG.error('HTTP shutdown cleanup failed: %r', name)
+            if first_error is not None:
+                reraise(*first_error)
         finally:
-            if server:
-                try:
-                    server.kill()
-                finally:
-                    server.server_close()
+            # Do not retain this frame through the saved exception traceback.
+            first_error = None
 
     def run(self, options=None, http_req_handler=HttpReqHandler,
             http_server_class=KillableThreadingHTTPServer):

{httpdis-0.6.30 → httpdis-0.6.32/httpdis.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: httpdis
-Version: 0.6.30
+Version: 0.6.32
 Summary: httpdis
 Home-page: https://github.com/decryptus/httpdis
 Author: Adrien Delle Cave
@@ -237,7 +237,10 @@ Routes, authentication, response formats, route/global body-limit fallback and
 lifecycle callback arguments remain compatible. Handler classes are now bound
 through a subclass rather than modified in place. Repeated `stop()` calls no
 longer repeat shutdown hooks. Startup/serving failures close the created socket,
-and shutdown-hook failures still trigger transport cleanup.
+and shutdown-hook failures do not skip subsequent hooks or transport cleanup.
+Shutdown attempts every registered cleanup and re-raises the first failure with
+its traceback, even if later hooks or transport cleanup also fail. Reentrant
+and repeated `stop()` calls do not run the hooks again.
 
 The default schema is defined once in `httpdis.config`. Both historical
 `DEFAULT_OPTIONS` import paths remain independent dictionaries with the same
@@ -462,9 +465,43 @@ is accepted; incompatible databases are refused, never silently reset. JSON
 records are bounded to 64 KiB and support the existing four namespaces. Redis
 and automatic schema migrations are not supplied by this adapter.
 
-**Browser integration is still pending:** this backend does not expose login/logout
-routes, set cookies, configure HTTPS/CORS, enforce request Origin or provide TOTP.
-The caller must mark every cookie-authenticated mutation for CSRF validation; do
-not expose a cookie provider without the complete browser transport protections.
-Only the token-only provider is supplied in this step. Session/login APIs are
-neutral services ready for the subsequent transport integration.
+### Browser session transport
+
+`httpdis.auth_browser.BrowserAuthProvider(service, origin, cookie_prefix='httpdis')`
+adds an opt-in cookie adapter over the same `LocalAuthService`. The daemon supplies
+the service, backend, public origin and lifecycle; HTTPdis installs no routes.
+`BearerAuthProvider` remains token-only and legacy Basic behavior is unchanged.
+
+The provider's `login(AuthenticationRequest, principal, password)` returns the
+existing redacted session grant. Send `provider.cookie(grant.secret, max_age)` as
+`Set-Cookie`, and return only the CSRF value and identity to browser JavaScript.
+Do not return the session secret in JSON or store it in browser JavaScript storage.
+Use `provider.logout(request)` before sending `provider.expired_cookie()`.
+Login rotates any previous cookie session, and logout requires the current CSRF.
+The service already enforces password hashing, login limits, idle/absolute expiry,
+account revision, disable and persistent revocation.
+
+HTTPS cookies use `__Host-<prefix>-session`, `Secure`, `HttpOnly`, `SameSite=Strict`,
+`Path=/`, a bounded `Max-Age`, and no Domain attribute. HTTP is accepted only for
+literal `127.0.0.1` / `::1` development origins, with an unprefixed non-Secure cookie.
+The configured origin must have no path; standard ports are canonicalized.
+Use a dedicated origin: unrelated applications on the same origin share browser
+security boundaries. Behind TLS termination, configure the external HTTPS origin,
+preserve Host, and keep direct backend access private. Forwarded headers are never
+trusted to choose the origin or weaken cookie policy.
+
+Cookie reads require the configured Host and reject foreign Origin/fetch metadata.
+Every cookie mutation requires exact Origin, JSON Content-Type and X-CSRF-Token.
+Login requires the same Origin/JSON checks even before a session exists. Duplicate
+security headers/cookies and mixed Bearer/session credentials are rejected. Explicit
+Bearer clients without browser metadata continue to work without cookies or Origin.
+
+Embedding requirements: serve only fixed public login/assets routes; protect all
+business routes; bound login request bodies; prohibit CORS/preflight in browser
+mode; apply no-store, CSP, frame denial and nosniff headers to errors as well as
+successes; never log credentials, payloads or cookies. `require_browser` is exposed
+for checking public routes before parsing their body. HTTPdis's historical generic
+OPTIONS behavior is unchanged: override it in the embedding browser handler.
+Application scopes, ownership and action confirmation remain application policy.
+This adapter supplies no HTML UI, proxy configuration, TOTP or SSO.
+

{httpdis-0.6.30 → httpdis-0.6.32}/httpdis.egg-info/SOURCES.txt

@@ -10,6 +10,7 @@ setup.py
 setup.yml
 httpdis/__init__.py
 httpdis/auth_backend.py
+httpdis/auth_browser.py
 httpdis/auth_sqlite.py
 httpdis/authentication.py
 httpdis/config.py
@@ -22,6 +23,7 @@ httpdis.egg-info/top_level.txt
 httpdis/ext/__init__.py
 httpdis/ext/httpdis_json.py
 tests/test_auth_backend.py
+tests/test_auth_browser.py
 tests/test_auth_sqlite.py
 tests/test_authentication_provider.py
 tests/test_body_limits.py

{httpdis-0.6.30 → httpdis-0.6.32}/setup.yml

@@ -4,8 +4,8 @@ description: httpdis
 author: Adrien Delle Cave
 author_email: pypi@doowan.net
 copyright: '2022 Adrien Delle Cave'
-release: '0.6.30'
-version: '0.6.30'
+release: '0.6.32'
+version: '0.6.32'
 license: License GPL-3
 url: https://github.com/decryptus/httpdis
 python_requires:

httpdis-0.6.32/tests/test_auth_browser.py

@@ -0,0 +1,111 @@
+"""Browser policy against real session services; no framework request dependency."""
+import unittest
+from httpdis.auth_backend import LocalAuthService, MemoryAuthStore
+from httpdis.auth_browser import BrowserAuthProvider, browser_origin
+from httpdis.authentication import AuthenticationDenied, AuthenticationRequest
+from test_auth_backend import FixturePasswords
+
+
+class BrowserTests(unittest.TestCase):
+    def setUp(self):
+        self.now = 100
+        self.service = LocalAuthService(MemoryAuthStore(), FixturePasswords(), clock=lambda: self.now,
+                                        session_ttl=100, idle_ttl=20)
+        self.service.provision('alice', 'correct-password', ['read', 'run'])
+        self.provider = BrowserAuthProvider(self.service, 'https://auton.example', 'autond')
+
+    def request(self, method='GET', cookie=None, csrf=None, **headers):
+        values = {'host': 'auton.example', 'origin': 'https://auton.example',
+                  'content-type': 'application/json', 'sec-fetch-site': 'same-origin'}
+        if cookie is not None:
+            values['cookie'] = cookie
+        if csrf is not None:
+            values['x-csrf-token'] = csrf
+        values.update(headers)
+        return AuthenticationRequest(method, '/route', tuple((k, v) for k, v in values.items() if v is not None), '127.0.0.1')
+
+    def login(self):
+        return self.provider.login(self.request('POST'), 'alice', 'correct-password')
+
+    def cookie(self, grant):
+        return self.provider.cookie_name + '=' + grant.secret
+
+    def test_login_cookie_csrf_logout_and_rotation(self):
+        first = self.login()
+        cookie = self.cookie(first)
+        header = self.provider.cookie(first.secret, 100)
+        self.assertTrue(header.startswith('__Host-autond-session='))
+        for flag in ('HttpOnly', 'SameSite=Strict', 'Secure', 'Path=/', 'Max-Age=100'):
+            self.assertIn(flag, header)
+        self.assertNotIn('Domain', header)
+        self.assertEqual(self.provider.authenticate(self.request(cookie=cookie)).principal, 'alice')
+        for csrf in (None, 'wrong'):
+            with self.assertRaises(AuthenticationDenied):
+                self.provider.authenticate(self.request('POST', cookie, csrf))
+        self.assertEqual(self.provider.authenticate(self.request('POST', cookie, first.csrf)).method, 'session')
+        second = self.provider.login(self.request('POST', cookie), 'alice', 'correct-password')
+        self.assertNotEqual(second.secret, first.secret)
+        with self.assertRaises(AuthenticationDenied):
+            self.provider.authenticate(self.request(cookie=cookie))
+        self.provider.logout(self.request('POST', self.cookie(second), second.csrf))
+        with self.assertRaises(AuthenticationDenied):
+            self.provider.authenticate(self.request(cookie=self.cookie(second)))
+        self.assertIn('Max-Age=0', self.provider.expired_cookie())
+
+    def test_origin_host_fetch_metadata_and_json_before_login(self):
+        for headers in ({'origin': None}, {'origin': 'null'}, {'origin': 'https://evil.example'},
+                        {'host': 'evil.example'}, {'sec-fetch-site': 'same-site'},
+                        {'sec-fetch-site': 'cross-site'}, {'content-type': 'text/plain'},
+                        {'content-type': 'application/x-www-form-urlencoded'}, {'authorization': 'Basic bad'}):
+            with self.assertRaises(AuthenticationDenied):
+                self.provider.login(self.request('POST', **headers), 'alice', 'correct-password')
+        with self.service.store.transaction() as tx:
+            self.assertEqual(tx.items('sessions'), [])
+            self.assertEqual(tx.items('attempts'), [])
+        grant = self.login()
+        for headers in ({'origin': 'https://evil.example'}, {'host': 'evil.example'},
+                        {'sec-fetch-site': 'same-site'}):
+            with self.assertRaises(AuthenticationDenied):
+                self.provider.authenticate(self.request(cookie=self.cookie(grant), **headers))
+        self.assertEqual(self.provider.authenticate(self.request(cookie=self.cookie(grant), origin=None)).principal, 'alice')
+
+    def test_no_ambiguous_cookie_or_credential_fallback(self):
+        grant = self.login()
+        token = self.service.issue_token('alice', ['read'], 20)
+        authorization = 'Bearer ' + token.secret
+        request = self.request(authorization=authorization, origin=None, **{'sec-fetch-site': None})
+        self.assertEqual(self.provider.authenticate(request).method, 'token')
+        for cookie in (self.cookie(grant) + '; ' + self.cookie(grant),
+                       self.provider.cookie_name + '=bad', 'x=' + 'a' * 9000):
+            with self.assertRaises(AuthenticationDenied):
+                self.provider.authenticate(self.request(cookie=cookie))
+        with self.assertRaises(AuthenticationDenied):
+            self.provider.authenticate(self.request(cookie=self.cookie(grant), authorization=authorization))
+        with self.assertRaises(AuthenticationDenied):
+            self.provider.authenticate(self.request(authorization='Basic ignored'))
+        request = self.request('POST')
+        duplicate = request._replace(headers=request.headers + (('origin', 'https://auton.example'),))
+        with self.assertRaises(AuthenticationDenied):
+            self.provider.login(duplicate, 'alice', 'correct-password')
+
+    def test_session_expiry_revocation_and_principal_scopes_are_shared(self):
+        grant = self.login()
+        self.now += 21
+        with self.assertRaises(AuthenticationDenied):
+            self.provider.authenticate(self.request(cookie=self.cookie(grant)))
+        grant = self.login()
+        self.service.disable('alice')
+        with self.assertRaises(AuthenticationDenied):
+            self.provider.authenticate(self.request(cookie=self.cookie(grant)))
+
+    def test_origin_configuration_and_loopback_development(self):
+        self.assertEqual(browser_origin('https://Auton.Example:443'), 'https://auton.example')
+        for origin in ('http://remote.example', 'http://localhost', 'https://x/', 'https://x?',
+                       'https://x#', 'https://user:pass@x', 'https://x:0', 'https://x:70000',
+                       'https://x:\n', 'https://x\\evil', '', None):
+            with self.assertRaises(ValueError):
+                browser_origin(origin)
+        local = BrowserAuthProvider(self.service, 'http://127.0.0.1:8666', 'autond')
+        self.assertEqual(local.cookie_name, 'autond-session')
+        self.assertNotIn('Secure', local.cookie('a' * 43, 10))
+        self.assertEqual(browser_origin('http://[::1]:8666'), 'http://[::1]:8666')

{httpdis-0.6.30 → httpdis-0.6.32}/tests/test_context.py

@@ -246,6 +246,54 @@ class ContextTests(unittest.TestCase):
         self.assertEqual(server.kill.call_count, 1)
         self.assertEqual(server.server_close.call_count, 1)
 
+    def test_stop_runs_all_cleanup_and_preserves_first_failure(self):
+        # Include BaseException: an extension's SystemExit must not bypass cleanup.
+        for first_error in (ValueError('first'), SystemExit('first')):
+            context = h.HttpServerContext()
+            calls = []
+            def first():
+                calls.append('first')
+                context.stop()  # Reentrant stop must not repeat callbacks.
+                raise first_error
+            def second():
+                calls.append('second')
+                raise RuntimeError('second')
+            def last():
+                calls.append('last')
+            context.register(lambda request: None, 'GET', name='first', at_stop=first)
+            context.register(lambda request: None, 'GET', name='second', at_stop=second)
+            context.register(lambda request: None, 'GET', name='last', at_stop=last)
+            # Dictionary order is not guaranteed on supported legacy interpreters.
+            from collections import OrderedDict
+            context.commands = OrderedDict((name, context.commands['GET /' + name])
+                                           for name in ('first', 'second', 'last'))
+            server = mock.Mock()
+            server.kill.side_effect = RuntimeError('kill')
+            server.server_close.side_effect = RuntimeError('close')
+            context.server = server
+            with self.assertRaises(type(first_error)) as caught:
+                context.stop()
+            self.assertIs(caught.exception, first_error)
+            self.assertEqual(calls, ['first', 'second', 'last'])
+            context.stop()
+            self.assertEqual(calls, ['first', 'second', 'last'])
+            self.assertEqual(server.kill.call_count, 1)
+            self.assertEqual(server.server_close.call_count, 1)
+
+    def test_transport_failure_still_attempts_close_and_is_propagated(self):
+        for failing_method in ('kill', 'server_close'):
+            context = h.HttpServerContext()
+            server = mock.Mock()
+            first_error = RuntimeError(failing_method)
+            getattr(server, failing_method).side_effect = first_error
+            context.server = server
+            with self.assertRaises(RuntimeError) as caught:
+                context.stop()
+            self.assertIs(caught.exception, first_error)
+            context.stop()
+            self.assertEqual(server.kill.call_count, 1)
+            self.assertEqual(server.server_close.call_count, 1)
+
     def test_custom_stdlib_handler_class_can_be_bound(self):
         from six.moves.BaseHTTPServer import BaseHTTPRequestHandler
         bound = h.HttpServerContext().bind_handler(BaseHTTPRequestHandler)

httpdis-0.6.30/RELEASE

@@ -1 +0,0 @@
-0.6.30

httpdis-0.6.30/VERSION

@@ -1 +0,0 @@
-0.6.30