src/Antiforgery/test/DefaultClaimUidExtractorTest.cs - main - githubmirror/aspnetcore

src/Antiforgery/test/DefaultClaimUidExtractorTest.cs
253 строки9 KB
Korolev Dmitry
Antiforgery perf improvements (includes new DataProtection API usage) (#64751)
29 янв 2026, 23:38
29 янв 2026, 23:38f87c18f
// Licensed to the .NET Foundation under one or more agreements.
// The .NET Foundation licenses this file to you under the MIT license.

using System.Security.Claims;
using Microsoft.Extensions.ObjectPool;
using Moq;

namespace Microsoft.AspNetCore.Antiforgery.Internal;

public class DefaultClaimUidExtractorTest
{
    private readonly DefaultClaimUidExtractor _claimUidExtractor;

    public DefaultClaimUidExtractorTest()
    {
        _claimUidExtractor = new DefaultClaimUidExtractor();
    }

    [Fact]
    public void ExtractClaimUid_Unauthenticated()
    {
        var mockIdentity = new Mock<ClaimsIdentity>();
        mockIdentity.Setup(o => o.IsAuthenticated)
                    .Returns(false);

        // Act
        var claimUid = new byte[32];
        var result = _claimUidExtractor.TryExtractClaimUidBytes(new ClaimsPrincipal(mockIdentity.Object), claimUid);

        // Assert
        Assert.False(result);
    }

    [Fact]
    public void ExtractClaimUid_ClaimsIdentity()
    {
        // Arrange
        var mockIdentity = new Mock<ClaimsIdentity>();
        mockIdentity.Setup(o => o.IsAuthenticated)
                    .Returns(true);
        mockIdentity.Setup(o => o.Claims).Returns([new Claim(ClaimTypes.Name, "someName")]);

        // Act
        var claimUid = new byte[32];
        var result = _claimUidExtractor.TryExtractClaimUidBytes(new ClaimsPrincipal(mockIdentity.Object), claimUid);

        // Assert
        Assert.True(result);
        Assert.Equal("yhXE+2v4zSXHtRHmzm4cmrhZca2J0g7yTUwtUerdeF4=", Convert.ToBase64String(claimUid));
    }

    [Fact]
    public void DefaultUniqueClaimTypes_NotPresent_SerializesAllClaimTypes()
    {
        var identity = new ClaimsIdentity("someAuthentication");
        identity.AddClaim(new Claim(ClaimTypes.Email, "someone@antiforgery.com"));
        identity.AddClaim(new Claim(ClaimTypes.GivenName, "some"));
        identity.AddClaim(new Claim(ClaimTypes.Surname, "one"));
        identity.AddClaim(new Claim(ClaimTypes.NameIdentifier, string.Empty));

        // Arrange
        var claimsIdentity = identity;

        // Act
        var identiferParameters = DefaultClaimUidExtractor.GetUniqueIdentifierParameters([claimsIdentity])!.ToArray();
        var claims = claimsIdentity.Claims.ToList();
        claims.Sort((a, b) => string.Compare(a.Type, b.Type, StringComparison.Ordinal));

        // Assert
        int index = 0;
        foreach (var claim in claims)
        {
            Assert.Equal(identiferParameters[index++], claim.Type);
            Assert.Equal(identiferParameters[index++], claim.Value);
            Assert.Equal(identiferParameters[index++], claim.Issuer);
        }
    }

    [Fact]
    public void DefaultUniqueClaimTypes_Present()
    {
        // Arrange
        var identity = new ClaimsIdentity("someAuthentication");
        identity.AddClaim(new Claim("fooClaim", "fooClaimValue"));
        identity.AddClaim(new Claim(ClaimTypes.NameIdentifier, "nameIdentifierValue"));

        // Act
        var uniqueIdentifierParameters = DefaultClaimUidExtractor.GetUniqueIdentifierParameters([identity]);

        // Assert
        Assert.Equal(new string[]
        {
                ClaimTypes.NameIdentifier,
                "nameIdentifierValue",
                "LOCAL AUTHORITY",
        }, uniqueIdentifierParameters);
    }

    [Fact]
    public void GetUniqueIdentifierParameters_PrefersSubClaimOverNameIdentifierAndUpn()
    {
        // Arrange
        var identity = new ClaimsIdentity("someAuthentication");
        identity.AddClaim(new Claim(ClaimTypes.NameIdentifier, "nameIdentifierValue"));
        identity.AddClaim(new Claim("sub", "subClaimValue"));
        identity.AddClaim(new Claim(ClaimTypes.Upn, "upnClaimValue"));

        // Act
        var uniqueIdentifierParameters = DefaultClaimUidExtractor.GetUniqueIdentifierParameters([identity]);

        // Assert
        Assert.Equal(new string[]
        {
                "sub",
                "subClaimValue",
                "LOCAL AUTHORITY",
        }, uniqueIdentifierParameters);
    }

    [Fact]
    public void GetUniqueIdentifierParameters_PrefersNameIdentifierOverUpn()
    {
        // Arrange
        var identity = new ClaimsIdentity("someAuthentication");
        identity.AddClaim(new Claim(ClaimTypes.NameIdentifier, "nameIdentifierValue"));
        identity.AddClaim(new Claim(ClaimTypes.Upn, "upnClaimValue"));

        // Act
        var uniqueIdentifierParameters = DefaultClaimUidExtractor.GetUniqueIdentifierParameters([identity]);

        // Assert
        Assert.Equal(new string[]
        {
                ClaimTypes.NameIdentifier,
                "nameIdentifierValue",
                "LOCAL AUTHORITY",
        }, uniqueIdentifierParameters);
    }

    [Fact]
    public void GetUniqueIdentifierParameters_UsesUpnIfPresent()
    {
        // Arrange
        var identity = new ClaimsIdentity("someAuthentication");
        identity.AddClaim(new Claim("fooClaim", "fooClaimValue"));
        identity.AddClaim(new Claim(ClaimTypes.Upn, "upnClaimValue"));

        // Act
        var uniqueIdentifierParameters = DefaultClaimUidExtractor.GetUniqueIdentifierParameters([identity]);

        // Assert
        Assert.Equal(new string[]
        {
                ClaimTypes.Upn,
                "upnClaimValue",
                "LOCAL AUTHORITY",
        }, uniqueIdentifierParameters);
    }

    [Fact]
    public void GetUniqueIdentifierParameters_MultipleIdentities_UsesOnlyAuthenticatedIdentities()
    {
        // Arrange
        var identity1 = new ClaimsIdentity(); // no authentication
        identity1.AddClaim(new Claim("sub", "subClaimValue"));
        var identity2 = new ClaimsIdentity("someAuthentication");
        identity2.AddClaim(new Claim(ClaimTypes.NameIdentifier, "nameIdentifierValue"));

        // Act
        var uniqueIdentifierParameters = DefaultClaimUidExtractor.GetUniqueIdentifierParameters([identity1, identity2]);

        // Assert
        Assert.Equal(new string[]
        {
                ClaimTypes.NameIdentifier,
                "nameIdentifierValue",
                "LOCAL AUTHORITY",
        }, uniqueIdentifierParameters);
    }

    [Fact]
    public void GetUniqueIdentifierParameters_NoKnownClaimTypesFound_SortsAndReturnsAllClaimsFromAuthenticatedIdentities()
    {
        // Arrange
        var identity1 = new ClaimsIdentity(); // no authentication
        identity1.AddClaim(new Claim("sub", "subClaimValue"));
        var identity2 = new ClaimsIdentity("someAuthentication");
        identity2.AddClaim(new Claim(ClaimTypes.Email, "email@domain.com"));
        var identity3 = new ClaimsIdentity("someAuthentication");
        identity3.AddClaim(new Claim(ClaimTypes.Country, "countryValue"));
        var identity4 = new ClaimsIdentity("someAuthentication");
        identity4.AddClaim(new Claim(ClaimTypes.Name, "claimName"));

        // Act
        var uniqueIdentifierParameters = DefaultClaimUidExtractor.GetUniqueIdentifierParameters([identity1, identity2, identity3, identity4]);

        // Assert
        Assert.Equal(new List<string>
            {
                ClaimTypes.Country,
                "countryValue",
                "LOCAL AUTHORITY",
                ClaimTypes.Email,
                "email@domain.com",
                "LOCAL AUTHORITY",
                ClaimTypes.Name,
                "claimName",
                "LOCAL AUTHORITY",
            }, uniqueIdentifierParameters);
    }

    [Fact]
    public void GetUniqueIdentifierParameters_PrefersNameFromFirstIdentity_OverSubFromSecondIdentity()
    {
        // Arrange
        var identity1 = new ClaimsIdentity("someAuthentication");
        identity1.AddClaim(new Claim(ClaimTypes.NameIdentifier, "nameIdentifierValue"));
        var identity2 = new ClaimsIdentity("someAuthentication");
        identity2.AddClaim(new Claim("sub", "subClaimValue"));

        // Act
        var uniqueIdentifierParameters = DefaultClaimUidExtractor.GetUniqueIdentifierParameters([identity1, identity2]);

        // Assert
        Assert.Equal(new string[]
        {
                ClaimTypes.NameIdentifier,
                "nameIdentifierValue",
                "LOCAL AUTHORITY",
        }, uniqueIdentifierParameters);
    }

    [Fact]
    public void GetUniqueIdentifierParameters_PrefersUpnFromFirstIdentity_OverNameFromSecondIdentity()
    {
        // Arrange
        var identity1 = new ClaimsIdentity("someAuthentication");
        identity1.AddClaim(new Claim(ClaimTypes.Upn, "upnValue"));
        var identity2 = new ClaimsIdentity("someAuthentication");
        identity2.AddClaim(new Claim(ClaimTypes.NameIdentifier, "nameIdentifierValue"));

        // Act
        var uniqueIdentifierParameters = DefaultClaimUidExtractor.GetUniqueIdentifierParameters([identity1, identity2]);

        // Assert
        Assert.Equal(new string[]
        {
                ClaimTypes.Upn,
                "upnValue",
                "LOCAL AUTHORITY",
        }, uniqueIdentifierParameters);
    }
}