test: confirm /api/v0/key/export is HTTP 404
This ensures key export endpoint is never exposed over HTTP API
Marcin Rataj committed
May 11, 2021 at 18:07 UTC
48bc5735fcd0477970644dcd3fbec2487816e71a
1 file changed
+7
-1
test/sharness/t0165-keystore.sh
+7
-1
@@ -175,6 +175,7 @@ ipfs key rm key_ed25519
175
test_cmp rsa_key_id roundtrip_rsa_key_id
176
'
177
178
+ # export works directly on the keystore present in IPFS_PATH
179
test_expect_success "export and import ed25519 key while daemon is running" '
180
edhash=$(ipfs key gen exported_ed25519_key --type=ed25519)
181
echo $edhash > ed25519_key_id
@@ -184,10 +185,15 @@ ipfs key rm key_ed25519
185
test_cmp ed25519_key_id roundtrip_ed25519_key_id
186
'
187
188
+ test_expect_success "key export over HTTP /api/v0/key/export is not possible" '
189
+ ipfs key gen nohttpexporttest_key --type=ed25519 &&
190
+ test_curl_resp_http_code "http://127.0.0.1:$API_PORT/api/v0/key/export&arg=nohttpexporttest_key" "HTTP/1.1 404 Not Found"
191
+ '
192
+
193
test_expect_success "online rotate rsa key" '
194
test_must_fail ipfs key rotate
195
'
190
-
196
+
197
test_kill_ipfs_daemon
198
199
}