From fa03333888f6812e28eacd23971d3dcf03e29981 Mon Sep 17 00:00:00 2001 From: Quick <31828688+Quick104@users.noreply.github.com> Date: Mon, 27 Jul 2026 18:12:47 +0000 Subject: [PATCH] test(auth): stop TestJWT_TamperedToken passing a valid signature MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The test overwrote the last character of the signature with "X". An HMAC-SHA256 signature is 32 bytes, so its base64url encoding is 43 characters and the final one carries only four significant bits — U, V, W and X all decode to the same trailing byte. Roughly one token in sixteen was therefore left byte-identical and validly signed, and the test failed because ValidateToken correctly accepted it. Measured at 3098/50000 (6.2%) over distinct signatures; it just failed the Go job on this branch for reasons unrelated to the branch. Flipping a character in the middle of the signature is 0/50000. Co-Authored-By: Claude Opus 5 (1M context) --- internal/auth/jwt_test.go | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/internal/auth/jwt_test.go b/internal/auth/jwt_test.go index fd18df4c..6a8a8c8b 100644 --- a/internal/auth/jwt_test.go +++ b/internal/auth/jwt_test.go @@ -181,8 +181,20 @@ func TestJWT_TamperedToken(t *testing.T) { t.Fatalf("GenerateAccessToken() error: %v", err) } - // Tamper with the token by modifying the last character of the signature. - tampered := token[:len(token)-1] + "X" + // Tamper with the token by flipping a bit in the middle of the signature. + // + // Not the last character: an HMAC-SHA256 signature is 32 bytes, so its + // base64url encoding is 43 characters and the last one carries only four + // significant bits. U, V, W and X all decode to the same trailing byte, so + // overwriting the last character with "X" left roughly one token in + // sixteen byte-identical and validly signed — a real 6% flake, measured + // over 50k distinct signatures. + middle := len(token) - 20 + flipped := byte('A') + if token[middle] == flipped { + flipped = 'B' + } + tampered := token[:middle] + string(flipped) + token[middle+1:] _, err = svc.ValidateToken(tampered) if err == nil {