void CheckAuthTest::TestValidToken(const std::string &auth_token,
                                   const std::string &user_info) {
  EXPECT_CALL(*raw_request_, FindHeader("x-goog-iap-jwt-assertion", _))
      .WillOnce(Invoke([](const std::string &, std::string *token) {
        *token = "";
        return false;
      }));
  EXPECT_CALL(*raw_request_, FindHeader(kAuthHeader, _))
      .WillOnce(Invoke([auth_token](const std::string &, std::string *token) {
        *token = std::string(kBearer) + auth_token;
        return true;
      }));
  EXPECT_CALL(*raw_request_, SetAuthToken(auth_token)).Times(1);
  EXPECT_CALL(*raw_env_, DoRunHTTPRequest(_))
      .Times(2)
      .WillOnce(Invoke([](HTTPRequest *req) {
        EXPECT_EQ(req->url(), kIssuer1OpenIdUrl);
        std::string body(kOpenIdContent);
        std::map<std::string, std::string> empty;
        req->OnComplete(Status::OK, std::move(empty), std::move(body));
      }))
      .WillOnce(Invoke([](HTTPRequest *req) {
        EXPECT_EQ(req->url(), kIssuer1PubkeyUrl);
        std::string body(kPubkey);
        std::map<std::string, std::string> empty;
        req->OnComplete(Status::OK, std::move(empty), std::move(body));
      }));
  std::cout << "need be replaced: " << user_info << std::endl;
  EXPECT_CALL(*raw_request_,
              AddHeaderToBackend(kEndpointApiUserInfo, user_info))
      .WillOnce(Return(utils::Status::OK));

  CheckAuth(context_, [](Status status) { ASSERT_TRUE(status.ok()); });
}
This attack-focused weakness is caused by improperly implemented authentication schemes that are subject to spoofing attacks.