EndpointsPeerAuthenticator implements PeerAuthenticator { @Override public boolean authenticate(HttpServletRequest request) { if (EnvUtil.isRunningOnAppEngine()) { return APPENGINE_PEER.equals(request.getHeader(HEADER_APPENGINE_PEER)); } if (localHostAddresses.contains(request.getRemoteAddr())) { logger.atFine().log("Skip endpoints peer verication from localhost."); return true; } GoogleIdToken idToken = jwtAuthenticator.verifyToken(request.getHeader(HEADER_PEER_AUTHORIZATION)); if (idToken == null || !SIGNER.equals(idToken.getPayload().getEmail()) || !matchHostAndPort(idToken, request)) { return false; } return true; } EndpointsPeerAuthenticator(); @VisibleForTesting  EndpointsPeerAuthenticator(GoogleJwtAuthenticator jwtAuthenticator); @Override boolean authenticate(HttpServletRequest request);  }
@Test public void testAuthenticate_localHost() throws Exception { request.setRemoteAddr(InetAddress.getLocalHost().getHostAddress()); assertTrue(authenticator.authenticate(request)); }
@Test public void testAuthenticate_localHostIp() { request.setRemoteAddr("127.0.0.1"); assertTrue(authenticator.authenticate(request)); }
@Test public void testAuthenticate_appEngineRunTimeNoXAppengineHeader() { System.setProperty(EnvUtil.ENV_APPENGINE_RUNTIME, "Production"); assertFalse(authenticator.authenticate(request)); }
@Test public void testAuthenticate_appEngineRunTimeUnmatchedXAppengineHeader() { System.setProperty(EnvUtil.ENV_APPENGINE_RUNTIME, "Production"); request.addHeader(EndpointsPeerAuthenticator.APPENGINE_PEER, "invalid"); assertFalse(authenticator.authenticate(request)); }
@Test public void testAuthenticate_appEngineRunTimeSuccess() { System.setProperty(EnvUtil.ENV_APPENGINE_RUNTIME, "Production"); request.addHeader(EndpointsPeerAuthenticator.HEADER_APPENGINE_PEER, EndpointsPeerAuthenticator.APPENGINE_PEER); assertTrue(authenticator.authenticate(request)); }
@Test public void testAuthenticate_noPeerAuthorizationHeader() { assertFalse(authenticator.authenticate(request)); }
@Test public void testAuthenticate_invalidHeader() { request.addHeader(EndpointsPeerAuthenticator.HEADER_PEER_AUTHORIZATION, FAKE_TOKEN); when(jwtAuthenticator.verifyToken(FAKE_TOKEN)).thenReturn(null); assertFalse(authenticator.authenticate(request)); }
@Test public void testAuthenticate_invalidEmail() { payload.setEmail("invalid@gmail.com"); request.addHeader(EndpointsPeerAuthenticator.HEADER_PEER_AUTHORIZATION, FAKE_TOKEN); when(jwtAuthenticator.verifyToken(FAKE_TOKEN)).thenReturn(token); when(token.getPayload()).thenReturn(payload); assertFalse(authenticator.authenticate(request)); }
@Test public void testAuthenticate_unmatchedHost() { payload.setEmail(EndpointsPeerAuthenticator.SIGNER); payload.setAudience("http: request.addHeader(EndpointsPeerAuthenticator.HEADER_PEER_AUTHORIZATION, FAKE_TOKEN); request.addHeader("Host", "myhost.com"); when(jwtAuthenticator.verifyToken(FAKE_TOKEN)).thenReturn(token); when(token.getPayload()).thenReturn(payload); assertFalse(authenticator.authenticate(request)); }
@Test public void testAuthenticate_unmatchedPortDefault() { payload.setEmail(EndpointsPeerAuthenticator.SIGNER); payload.setAudience("https: request.addHeader(EndpointsPeerAuthenticator.HEADER_PEER_AUTHORIZATION, FAKE_TOKEN); request.addHeader("Host", "myhost.com"); when(jwtAuthenticator.verifyToken(FAKE_TOKEN)).thenReturn(token); when(token.getPayload()).thenReturn(payload); assertFalse(authenticator.authenticate(request)); }
@Test public void testAuthenticate_unmatchedPort() { request = createRequest("myhost.com", 456, "", "", ""); request.setRemoteAddr("8.8.8.8"); payload.setEmail(EndpointsPeerAuthenticator.SIGNER); payload.setAudience("http: request.addHeader(EndpointsPeerAuthenticator.HEADER_PEER_AUTHORIZATION, FAKE_TOKEN); when(jwtAuthenticator.verifyToken(FAKE_TOKEN)).thenReturn(token); when(token.getPayload()).thenReturn(payload); assertFalse(authenticator.authenticate(request)); }
@Test public void testAuthenticate_success() { request = createRequest("myhost.com", 456, "", "", ""); request.setRemoteAddr("8.8.8.8"); payload.setEmail(EndpointsPeerAuthenticator.SIGNER); payload.setAudience("http: request.addHeader(EndpointsPeerAuthenticator.HEADER_PEER_AUTHORIZATION, FAKE_TOKEN); when(jwtAuthenticator.verifyToken(FAKE_TOKEN)).thenReturn(token); when(token.getPayload()).thenReturn(payload); assertTrue(authenticator.authenticate(request)); }