access.test.ts

apps/worker/test/access.test.ts

1. /**
2. * Verifying the Cloudflare Access assertion.
3. *
4. * This is tested hardest because everything else about who-sees-what depends on
5. * this function returning the right email, or null. If it can be made to return
6. * an attacker-chosen address, every other control in the system is decoration,
7. * the exec briefing included, and that one is specified as hard-enforced.
8. *
9. * The classic JWT failures are each covered below rather than assumed away: an
10. * unsigned `alg: none` token, a token signed by the wrong key, one minted for a
11. * different Access application, an expired one, and the spoofable email header on
12. * its own. Every one of them must produce null.
13. *
14. * These sign real RS256 tokens with a throwaway keypair and stub only the certs
15. * endpoint, so the signature path is genuinely exercised.
16. */
18. import { afterEach, beforeAll, describe, expect, it, vi } from 'vitest'
19. import { __resetKeyCache, identify } from '../src/access.js'
21. const TEAM = 'meridiandisplay.cloudflareaccess.com'
22. const AUD = 'aud-tag-for-this-application'
24. let keys: CryptoKeyPair
25. let otherKeys: CryptoKeyPair
26. let jwks: unknown
28. const b64url = (bytes: ArrayBuffer | Uint8Array): string => {
29. const b = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes)
30. return btoa(String.fromCharCode(...b)).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '')
31. }
32. const enc = (o: unknown) => b64url(new TextEncoder().encode(JSON.stringify(o)))
34. async function sign(
35. claims: Record<string, unknown>,
36. opts: { kid?: string; alg?: string; pair?: CryptoKeyPair } = {},
37. ): Promise<string> {
38. const header = { alg: opts.alg ?? 'RS256', kid: opts.kid ?? 'test-key', typ: 'JWT' }
39. const body = `${enc(header)}.${enc(claims)}`
40. const sig = await crypto.subtle.sign(
41. { name: 'RSASSA-PKCS1-v1_5' },
42. (opts.pair ?? keys).privateKey,
43. new TextEncoder().encode(body),
44. )
45. return `${body}.${b64url(sig)}`
46. }
48. const now = () => Math.floor(Date.now() / 1000)
49. const validClaims = (over: Record<string, unknown> = {}) => ({
50. aud: [AUD],
51. email: 'nora.l@meridiandisplay.example',
52. sub: 'user-123',
53. iss: `https://${TEAM}`,
54. exp: now() + 600,
55. iat: now() - 10,
56. ...over,
57. })
59. const reqWith = (token: string | null, extra: Record<string, string> = {}) =>
60. new Request('https://board.example/', {
61. headers: { ...(token ? { 'Cf-Access-Jwt-Assertion': token } : {}), ...extra },
62. })
64. beforeAll(async () => {
65. const params = { name: 'RSASSA-PKCS1-v1_5', modulusLength: 2048,
66. publicExponent: new Uint8Array([1, 0, 1]), hash: 'SHA-256' } as const
67. keys = await crypto.subtle.generateKey(params, true, ['sign', 'verify'])
68. otherKeys = await crypto.subtle.generateKey(params, true, ['sign', 'verify'])
69. const pub = await crypto.subtle.exportKey('jwk', keys.publicKey)
70. jwks = { keys: [{ kid: 'test-key', kty: 'RSA', n: pub.n, e: pub.e, alg: 'RS256' }] }
71. })
73. // Every test re-stubs fetch, and the module caches keys for five minutes, so
74. // the cache is reset between tests by re-importing is unnecessary here because
75. // the same key set is served throughout.
76. const stubCerts = (body: unknown = jwks, ok = true) =>
77. vi.stubGlobal('fetch', vi.fn(async () => ({ ok, status: ok ? 200 : 500, json: async () => body })))
79. afterEach(() => vi.unstubAllGlobals())
81. describe('a valid assertion identifies the person', () => {
82. it('returns the email from a properly signed token', async () => {
83. stubCerts()
84. const id = await identify(reqWith(await sign(validClaims())), TEAM, AUD)
85. expect(id?.email).toBe('nora.l@meridiandisplay.example')
86. })
88. it('lowercases and trims, so casing cannot dodge the roster match', async () => {
89. stubCerts()
90. const id = await identify(
91. reqWith(await sign(validClaims({ email: ' NORA.L@MeridianDisplay.example ' }))), TEAM, AUD)
92. expect(id?.email).toBe('nora.l@meridiandisplay.example')
93. })
95. it('accepts a string aud as well as an array', async () => {
96. stubCerts()
97. const id = await identify(reqWith(await sign(validClaims({ aud: AUD }))), TEAM, AUD)
98. expect(id?.email).toBe('nora.l@meridiandisplay.example')
99. })
100. })
102. describe('forged and mismatched assertions are refused', () => {
103. it('refuses a token signed by a different key', async () => {
104. // The whole point of verifying rather than decoding.
105. stubCerts()
106. const token = await sign(validClaims(), { pair: otherKeys })
107. expect(await identify(reqWith(token), TEAM, AUD)).toBeNull()
108. })
110. it('refuses alg: none, the oldest JWT hole there is', async () => {
111. stubCerts()
112. const header = enc({ alg: 'none', kid: 'test-key', typ: 'JWT' })
113. const token = `${header}.${enc(validClaims())}.`
114. expect(await identify(reqWith(token), TEAM, AUD)).toBeNull()
115. })
117. it('refuses a non-RS256 alg even when the signature is otherwise fine', async () => {
118. stubCerts()
119. const token = await sign(validClaims(), { alg: 'HS256' })
120. expect(await identify(reqWith(token), TEAM, AUD)).toBeNull()
121. })
123. it('refuses a token minted for a different Access application', async () => {
124. // Access teams commonly protect several apps. A token for another one is a
125. // real, signed token; only the audience says it is not for this board.
126. stubCerts()
127. const token = await sign(validClaims({ aud: ['some-other-application'] }))
128. expect(await identify(reqWith(token), TEAM, AUD)).toBeNull()
129. })
131. it('refuses an expired token', async () => {
132. stubCerts()
133. expect(await identify(reqWith(await sign(validClaims({ exp: now() - 5 }))), TEAM, AUD)).toBeNull()
134. })
136. it('refuses a token that is not valid yet', async () => {
137. stubCerts()
138. expect(await identify(reqWith(await sign(validClaims({ nbf: now() + 600 }))), TEAM, AUD)).toBeNull()
139. })
141. it('refuses a token from a different Access team', async () => {
142. stubCerts()
143. const token = await sign(validClaims({ iss: 'https://someoneelse.cloudflareaccess.com' }))
144. expect(await identify(reqWith(token), TEAM, AUD)).toBeNull()
145. })
147. it('refuses an issuer that merely CONTAINS the team domain', async () => {
148. // The check was `iss.includes(teamDomain)`, which this passes. Not
149. // exploitable (the signature still had to verify against our team's keys),
150. // but a check that only holds because another check is doing the work is not
151. // a check.
152. stubCerts()
153. for (const iss of [
154. `https://attacker.example/${TEAM}`,
155. `https://${TEAM}.attacker.example`,
156. `https://evil-${TEAM}`,
157. ]) {
158. expect(await identify(reqWith(await sign(validClaims({ iss }))), TEAM, AUD), iss).toBeNull()
159. }
160. })
162. it('refuses a token whose kid matches no current signing key', async () => {
163. stubCerts()
164. expect(await identify(reqWith(await sign(validClaims(), { kid: 'rotated-away' })), TEAM, AUD)).toBeNull()
165. })
167. it('refuses a token carrying no email claim', async () => {
168. stubCerts()
169. const c = validClaims(); delete (c as Record<string, unknown>).email
170. expect(await identify(reqWith(await sign(c)), TEAM, AUD)).toBeNull()
171. })
172. })
174. describe('the email header alone proves nothing', () => {
175. it('refuses a request carrying only Cf-Access-Authenticated-User-Email', async () => {
176. // The reason this file exists: that header is trivially settable by whoever
177. // sends the request, and the Worker is on a publicly routable workers.dev
178. // hostname. Access sits in front by configuration, not by physics.
179. stubCerts()
180. const req = reqWith(null, { 'Cf-Access-Authenticated-User-Email': 'nora.l@meridiandisplay.example' })
181. expect(await identify(req, TEAM, AUD)).toBeNull()
182. })
184. it('refuses a request with no assertion at all', async () => {
185. stubCerts()
186. expect(await identify(reqWith(null), TEAM, AUD)).toBeNull()
187. })
189. it('refuses a malformed assertion', async () => {
190. stubCerts()
191. for (const junk of ['', 'not-a-jwt', 'a.b', 'a.b.c.d', '...']) {
192. expect(await identify(reqWith(junk), TEAM, AUD), junk).toBeNull()
193. }
194. })
195. })
197. describe('an unconfigured Worker fails closed', () => {
198. it('refuses everything when the team domain is unset', async () => {
199. stubCerts()
200. expect(await identify(reqWith(await sign(validClaims())), undefined, AUD)).toBeNull()
201. })
203. it('refuses everything when the audience is unset', async () => {
204. stubCerts()
205. expect(await identify(reqWith(await sign(validClaims())), TEAM, undefined)).toBeNull()
206. })
208. it('refuses when the certs endpoint cannot be reached', async () => {
209. // Serving the board to everyone because a key fetch failed would be the worst
210. // possible failure mode. The cache is cleared first: with keys already warm
211. // this would pass without ever attempting a fetch, which is the test lying.
212. __resetKeyCache()
213. stubCerts({}, false)
214. expect(await identify(reqWith(await sign(validClaims())), TEAM, AUD)).toBeNull()
215. })
217. it('serves from cache rather than fetching keys on every request', async () => {
218. __resetKeyCache()
219. const f = vi.fn(async () => ({ ok: true, status: 200, json: async () => jwks }))
220. vi.stubGlobal('fetch', f)
221. const token = await sign(validClaims())
222. await identify(reqWith(token), TEAM, AUD)
223. await identify(reqWith(token), TEAM, AUD)
224. expect(f).toHaveBeenCalledTimes(1)
225. })
226. })