|
| 1 | +// security_interim_only_test.go - Tests --interim-page-auth flag |
| 2 | +// |
| 3 | +// Verifies the --interim-page-auth flag behavior: |
| 4 | +// - Main application: accessible without authentication (200 OK) |
| 5 | +// - Interim pages & logs API: requires authentication (302 redirect) |
| 6 | + |
| 7 | +package integration |
| 8 | + |
| 9 | +import ( |
| 10 | + "context" |
| 11 | + "fmt" |
| 12 | + "net/http" |
| 13 | + "os" |
| 14 | + "os/exec" |
| 15 | + "testing" |
| 16 | + "time" |
| 17 | +) |
| 18 | + |
| 19 | +// TestInterimPageAuthFlag tests the --interim-page-auth flag |
| 20 | +// This flag allows protecting interim pages and logs API while keeping the main app public |
| 21 | +func TestInterimPageAuthFlag(t *testing.T) { |
| 22 | + // Get free ports for proxy and subprocess |
| 23 | + proxyPort := getFreePort(t) |
| 24 | + destPort := getFreePort(t) |
| 25 | + |
| 26 | + // Build the binary first |
| 27 | + binaryPath := buildBinary(t) |
| 28 | + |
| 29 | + // Start jhub-app-proxy with --authtype=none but --interim-page-auth=true |
| 30 | + ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second) |
| 31 | + defer cancel() |
| 32 | + |
| 33 | + cmd := exec.CommandContext(ctx, binaryPath, |
| 34 | + "--port", fmt.Sprintf("%d", proxyPort), |
| 35 | + "--destport", fmt.Sprintf("%d", destPort), |
| 36 | + "--authtype", "none", // Main app is PUBLIC |
| 37 | + "--interim-page-auth", // But interim pages are PROTECTED |
| 38 | + "--log-format", "pretty", |
| 39 | + "--log-level", "info", |
| 40 | + "--", |
| 41 | + "python3", "-m", "http.server", "{port}", |
| 42 | + ) |
| 43 | + |
| 44 | + // Set minimal JupyterHub environment variables (required for OAuth) |
| 45 | + cmd.Env = append(os.Environ(), |
| 46 | + "JUPYTERHUB_API_TOKEN=test-token-12345", |
| 47 | + "JUPYTERHUB_API_URL=http://localhost:8081/hub/api", |
| 48 | + "JUPYTERHUB_USER=testuser", |
| 49 | + "JUPYTERHUB_SERVICE_PREFIX=/user/testuser/", |
| 50 | + ) |
| 51 | + |
| 52 | + cmd.Stdout = os.Stdout |
| 53 | + cmd.Stderr = os.Stderr |
| 54 | + |
| 55 | + if err := cmd.Start(); err != nil { |
| 56 | + t.Fatalf("Failed to start jhub-app-proxy: %v", err) |
| 57 | + } |
| 58 | + defer func() { |
| 59 | + if cmd.Process != nil { |
| 60 | + cmd.Process.Kill() |
| 61 | + } |
| 62 | + }() |
| 63 | + |
| 64 | + proxyURL := fmt.Sprintf("http://127.0.0.1:%d", proxyPort) |
| 65 | + servicePrefix := "/user/testuser" |
| 66 | + interimPath := servicePrefix + "/_temp/jhub-app-proxy" |
| 67 | + |
| 68 | + // Wait for proxy to be ready (use main app since interim is protected) |
| 69 | + if err := waitForHTTP(proxyURL+servicePrefix+"/", 5*time.Second); err != nil { |
| 70 | + t.Fatalf("Proxy did not become ready: %v", err) |
| 71 | + } |
| 72 | + |
| 73 | + // Give the subprocess time to fully start (we can't use stats API since it's protected) |
| 74 | + time.Sleep(3 * time.Second) |
| 75 | + |
| 76 | + // Test 1: Main app should be PUBLIC (no auth required) |
| 77 | + t.Run("MainAppIsPublic", func(t *testing.T) { |
| 78 | + resp, err := http.Get(proxyURL + servicePrefix + "/") |
| 79 | + if err != nil { |
| 80 | + t.Fatalf("Failed to request main app: %v", err) |
| 81 | + } |
| 82 | + defer resp.Body.Close() |
| 83 | + |
| 84 | + // Should return 200 OK - app is public! |
| 85 | + if resp.StatusCode != 200 { |
| 86 | + t.Errorf("Expected 200 for public app, got %d", resp.StatusCode) |
| 87 | + } |
| 88 | + }) |
| 89 | + |
| 90 | + // Test 2: Interim page should be PROTECTED (auth required) |
| 91 | + t.Run("InterimPageIsProtected", func(t *testing.T) { |
| 92 | + client := &http.Client{ |
| 93 | + CheckRedirect: func(req *http.Request, via []*http.Request) error { |
| 94 | + return http.ErrUseLastResponse |
| 95 | + }, |
| 96 | + } |
| 97 | + resp, err := client.Get(proxyURL + interimPath) |
| 98 | + if err != nil { |
| 99 | + t.Fatalf("Failed to request interim page: %v", err) |
| 100 | + } |
| 101 | + defer resp.Body.Close() |
| 102 | + |
| 103 | + // Should NOT return 200 - interim page is protected! |
| 104 | + if resp.StatusCode == 200 { |
| 105 | + t.Errorf("SECURITY ISSUE: Interim page should be protected but got 200") |
| 106 | + } |
| 107 | + |
| 108 | + // Should redirect to OAuth |
| 109 | + if resp.StatusCode != 302 { |
| 110 | + t.Errorf("Expected 302 redirect for protected interim page, got %d", resp.StatusCode) |
| 111 | + } |
| 112 | + }) |
| 113 | + |
| 114 | + // Test 3: Logs API should be PROTECTED (auth required) |
| 115 | + t.Run("LogsAPIIsProtected", func(t *testing.T) { |
| 116 | + client := &http.Client{ |
| 117 | + CheckRedirect: func(req *http.Request, via []*http.Request) error { |
| 118 | + return http.ErrUseLastResponse |
| 119 | + }, |
| 120 | + } |
| 121 | + resp, err := client.Get(proxyURL + interimPath + "/api/logs/all") |
| 122 | + if err != nil { |
| 123 | + t.Fatalf("Failed to request logs API: %v", err) |
| 124 | + } |
| 125 | + defer resp.Body.Close() |
| 126 | + |
| 127 | + // Should NOT return 200 - logs API is protected! |
| 128 | + if resp.StatusCode == 200 { |
| 129 | + t.Errorf("SECURITY ISSUE: Logs API should be protected but got 200") |
| 130 | + } |
| 131 | + |
| 132 | + // Should redirect to OAuth |
| 133 | + if resp.StatusCode != 302 { |
| 134 | + t.Errorf("Expected 302 redirect for protected logs API, got %d", resp.StatusCode) |
| 135 | + } |
| 136 | + }) |
| 137 | +} |
0 commit comments