diff options
Diffstat (limited to 'tests/test_core.c')
| -rw-r--r-- | tests/test_core.c | 30 |
1 files changed, 29 insertions, 1 deletions
diff --git a/tests/test_core.c b/tests/test_core.c index 6376517..a82c833 100644 --- a/tests/test_core.c +++ b/tests/test_core.c @@ -4904,7 +4904,15 @@ static void test_rate_limit(struct tctx *t) (void)t; yyjson_doc *d; - /* rate limiting must stay last: it blocks the login key */ + CHECK(login("admin", "secret123")); + d = call(reqf("{\"v\":1,\"id\":\"31\",\"cmd\":\"user.create\"," + "\"session\":\"%s\",\"args\":{\"username\":\"rluser\"," + "\"password\":\"rlpassword1\"}}", + g_session)); + CHECK_OK(d); + yyjson_doc_free(d); + + /* rate limiting must stay last: it blocks the admin login */ for (int i = 0; i < 5; i++) CHECK(!login("admin", "wrong")); d = call("{\"v\":1,\"id\":\"32\",\"cmd\":\"session.open\",\"args\":" @@ -4912,6 +4920,26 @@ static void test_rate_limit(struct tctx *t) "\"password\":\"secret123\"}}"); CHECK_STR(d, "error.code", "RATE_LIMITED"); yyjson_doc_free(d); + /* the limit is per user name: guessing one account never locks out + the others (a public login page must not be a lockout switch) */ + for (int i = 0; i < 5; i++) + CHECK(!login("nobody-here", "wrong")); + CHECK(login("rluser", "rlpassword1")); + /* flooding the table with names neither frees admin early nor turns + the limiter off */ + char name[32]; + for (int i = 0; i < 1100; i++) { + snprintf(name, sizeof name, "flood%d", i); + login(name, "x"); + } + d = call("{\"v\":1,\"id\":\"33\",\"cmd\":\"session.open\",\"args\":" + "{\"method\":\"password\",\"username\":\"admin\"," + "\"password\":\"secret123\"}}"); + CHECK_STR(d, "error.code", "RATE_LIMITED"); + yyjson_doc_free(d); + for (int i = 0; i < 5; i++) + CHECK(!login("rluser", "wrong")); + CHECK(!login("rluser", "rlpassword1")); } static void test_employees(struct tctx *t) |