38 lines
1.7 KiB
Markdown
38 lines
1.7 KiB
Markdown
# Fake Tinyauth protocol peer - local development only
|
|
|
|
This is NOT authentication. Any client can mint the allow cookie. The fixture binds
|
|
only to 127.0.0.1 and must never protect a production application.
|
|
|
|
```bash
|
|
bash dev.sh mock --port 9001 --name origin-a --ttl 30
|
|
# Separate terminal:
|
|
bash dev.sh mock-auth --port 9300
|
|
```
|
|
|
|
In a disposable vhost's Authentication tab, set:
|
|
- verifier: http://127.0.0.1:9300 (adds /api/auth/nginx)
|
|
- login: http://127.0.0.1:9300/login
|
|
- explicitly allow private verifier IPs
|
|
- forwarded identities: remote-user and remote-email
|
|
|
|
Use your actual frontend address/hostname. Example for a local plain-HTTP vhost:
|
|
|
|
```bash
|
|
# Denied -> 302 to configured login, no application request:
|
|
curl -i -H 'Host: app.localhost' http://127.0.0.2:8181/inspect
|
|
# Allowed -> app receives mock-user / mock@example.test; cache remains BYPASS:
|
|
curl -i -H 'Host: app.localhost' -H 'Cookie: mock_auth=allow' http://127.0.0.2:8181/inspect
|
|
# Force authentication failure even with an allow cookie:
|
|
curl -X POST -H 'Content-Type: application/json' -d '{"status":503}' http://127.0.0.1:9300/control
|
|
# Simulate slow verifier; choose less than or greater than the vhost total timeout:
|
|
curl -X POST -H 'Content-Type: application/json' -d '{"delay_ms":12000}' http://127.0.0.1:9300/control
|
|
# Restore default deny/allow behavior:
|
|
curl -X POST -H 'Content-Type: application/json' -d '{"reset":true}' http://127.0.0.1:9300/control
|
|
curl http://127.0.0.1:9300/state
|
|
```
|
|
|
|
/control replaces status/delay/redirect behavior (omitted values reset to defaults).
|
|
Optional location sets X-Tinyauth-Location for redirect-policy tests. /state exposes
|
|
only the last 16 metadata records, not Authorization, cookies or query strings.
|
|
Real Rust-router auth tests are in tests/integrations.rs.
|