From 193bbc450c1e86b25d3acd347af7e4cc41456aed7fa00a6d35aab33d95aefaf4 Mon Sep 17 00:00:00 2001 From: wlfb Date: Fri, 17 Jul 2026 18:07:20 +0200 Subject: [PATCH] fix: konstante Zeit fuer API-Key-Vergleich, Auth-Tests erweitert Co-Authored-By: Claude Fable 5 --- finance/app/auth.py | 2 +- finance/tests/test_auth.py | 16 ++++++++++++++++ 2 files changed, 17 insertions(+), 1 deletion(-) diff --git a/finance/app/auth.py b/finance/app/auth.py index 0373645..098c4b3 100644 --- a/finance/app/auth.py +++ b/finance/app/auth.py @@ -46,7 +46,7 @@ def session_valid(token: str | None) -> bool: def require_auth(request: Request) -> None: settings = get_settings() header = request.headers.get("authorization", "") - if settings.api_key and header == f"Bearer {settings.api_key}": + if settings.api_key and hmac.compare_digest(header, f"Bearer {settings.api_key}"): return if session_valid(request.cookies.get(COOKIE)): return diff --git a/finance/tests/test_auth.py b/finance/tests/test_auth.py index eedfcd7..875f112 100644 --- a/finance/tests/test_auth.py +++ b/finance/tests/test_auth.py @@ -12,3 +12,19 @@ def test_login_flow(client): follow_redirects=False) assert r.status_code == 303 assert client.get("/api/accounts").status_code == 200 # Cookie reicht + + +def test_logout_flow(client): + r = client.post("/login", data={"username": "admin", "password": "geheim"}, + follow_redirects=False) + assert r.status_code == 303 + assert client.get("/api/accounts").status_code == 200 + + r = client.post("/logout", follow_redirects=False) + assert r.status_code == 303 + assert client.get("/api/accounts").status_code == 401 + + +def test_tampered_session_cookie_rejected(client): + client.cookies.set("fb_session", "gui.invalid-signature") + assert client.get("/api/accounts").status_code == 401