54 lines
1.5 KiB
TypeScript
54 lines
1.5 KiB
TypeScript
import { expect, test } from "@playwright/test";
|
|
import {
|
|
getSetCookies,
|
|
readCookieFromSetCookieHeader,
|
|
} from "../helpers/auth-assertions.ts";
|
|
|
|
test.describe("Auth Session Isolation", () => {
|
|
test("login bootstrap emits distinct auth_trace_id values", async ({ playwright }) => {
|
|
const contextA = await playwright.request.newContext({
|
|
baseURL: "http://127.0.0.1:8080",
|
|
});
|
|
const contextB = await playwright.request.newContext({
|
|
baseURL: "http://127.0.0.1:8080",
|
|
});
|
|
|
|
const responseA = await contextA.get(
|
|
"/auth/login?return_path=/landlord/dashboard",
|
|
{
|
|
maxRedirects: 0,
|
|
},
|
|
);
|
|
const responseB = await contextB.get(
|
|
"/auth/login?return_path=/landlord/dashboard",
|
|
{
|
|
maxRedirects: 0,
|
|
},
|
|
);
|
|
|
|
const traceA = readCookieFromSetCookieHeader(
|
|
getSetCookies(responseA),
|
|
"auth_trace_id",
|
|
);
|
|
const traceB = readCookieFromSetCookieHeader(
|
|
getSetCookies(responseB),
|
|
"auth_trace_id",
|
|
);
|
|
|
|
expect(traceA).toBeTruthy();
|
|
expect(traceB).toBeTruthy();
|
|
expect(traceA).not.toBe(traceB);
|
|
|
|
await contextA.dispose();
|
|
await contextB.dispose();
|
|
});
|
|
|
|
test("login bootstrap clears stale auth cookies every time", async ({ request }) => {
|
|
const response = await request.get("/auth/login", { maxRedirects: 0 });
|
|
const setCookies = getSetCookies(response).join("\n");
|
|
|
|
expect(setCookies).toContain("session=");
|
|
expect(setCookies).toContain("xx_state_id=");
|
|
});
|
|
});
|