Package openid :: Package test :: Module test_server :: Class TestCheckAuth
[hide private]
[frames] | no frames]

Class TestCheckAuth

source code

unittest.TestCase --+
                    |
                   TestCheckAuth

Instance Methods [hide private]
 
setUp(self) source code
 
test_valid(self) source code
 
test_invalid(self) source code
 
test_replay(self)
Don't validate the same response twice.
source code
 
test_invalidatehandle(self) source code
 
test_invalidatehandleNo(self) source code
Method Details [hide private]

test_replay(self)

source code 

Don't validate the same response twice.

From "Checking the Nonce":

   When using "check_authentication", the OP MUST ensure that an
   assertion has not yet been accepted with the same value for
   "openid.response_nonce".

In this implementation, the assoc_handle is only valid once. And nonces are a signed component of the message, so they can't be used with another handle without breaking the sig.