接口测试中90%的Bug都藏在鉴权里：Cookie、Token、Signature深度拆解_千锋教育

import requests

# 模拟未登录状态调用接口
session = requests.Session()
response = session.get('https://api.example.com/user/info')
print(f"未登录状态码: {response.status_code}")  # 期望返回401或403

# 模拟登录后获取Cookie
login_data = {'username': 'test', 'password': 'test123'}
login_response = session.post('https://api.example.com/login', data=login_data)
print(f"登录后Cookie: {session.cookies.get_dict()}")

# 验证Cookie中是否有HttpOnly标记
for cookie in session.cookies:
    print(f"Cookie名称: {cookie.name}, HttpOnly: {cookie.has_nonstandard_attr('HttpOnly')}")

# CSRF测试
headers = {'Origin': 'https://malicious-site.com'}
response = requests.post('https://api.example.com/transfer', 
                        data={'amount': 1000}, 
                        cookies=session.cookies,
                        headers=headers)
print(f"跨域请求结果: {response.status_code}")  # 期望返回403

import jwt
import requests

# 测试JWT签名算法
def test_jwt_algorithm():
    # 使用'none'算法伪造Token
    fake_token = jwt.encode({'user_id': 1}, key='', algorithm='none')
    headers = {'Authorization': f'Bearer {fake_token}'}
    response = requests.get('https://api.example.com/user/info', headers=headers)
    print(f"none算法伪造Token结果: {response.status_code}")  # 期望返回401

    # 使用弱密钥破解
    weak_token = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyX2lkIjoxfQ.xxx"
    # 使用常见密码字典尝试破解
    common_keys = ['secret', 'password', '123456']
    for key in common_keys:
        try:
            decoded = jwt.decode(weak_token, key, algorithms=['HS256'])
            print(f"破解成功! 密钥: {key}")
            break
        except:
            pass

# 测试Payload泄露
def test_payload_leak():
    # 解析JWT的Payload部分
    token = "your_jwt_token_here"
    payload = jwt.decode(token, options={"verify_signature": False})
    sensitive_fields = ['password', 'phone', 'credit_card']
    for field in sensitive_fields:
        if field in payload:
            print(f"敏感信息泄露: {field}")

# 测试Refresh Token重用
def test_refresh_token_reuse():
    # 第一次刷新
    refresh_response = requests.post('https://api.example.com/refresh', 
                                    data={'refresh_token': 'xxx'})
    new_access_token = refresh_response.json()['access_token']
    
    # 第二次使用相同的Refresh Token
    second_response = requests.post('https://api.example.com/refresh', 
                                   data={'refresh_token': 'xxx'})
    print(f"Refresh Token重用结果: {second_response.status_code}")  # 期望返回403

import hashlib
import hmac
import time
import requests

def generate_signature(params, secret_key):
    # 参数排序
    sorted_params = sorted(params.items())
    # 拼接字符串
    sign_str = '&'.join([f"{k}={v}" for k, v in sorted_params])
    # HMAC-SHA256签名
    signature = hmac.new(secret_key.encode(), sign_str.encode(), hashlib.sha256).hexdigest()
    return signature

# 测试签名验证
def test_signature_verification():
    secret_key = 'test_secret'
    params = {
        'user_id': 1,
        'timestamp': int(time.time()),
        'nonce': 'random_string_123'
    }
    signature = generate_signature(params, secret_key)
    params['signature'] = signature
    
    # 正常请求
    response = requests.get('https://api.example.com/user/info', params=params)
    print(f"正常签名请求: {response.status_code}")  # 期望200
    
    # 篡改参数
    tampered_params = params.copy()
    tampered_params['user_id'] = 2
    response = requests.get('https://api.example.com/user/info', params=tampered_params)
    print(f"篡改参数请求: {response.status_code}")  # 期望403

# 测试时间戳过期
def test_timestamp_expiry():
    params = {
        'user_id': 1,
        'timestamp': int(time.time()) - 3600,  # 1小时前的签名
        'nonce': 'old_nonce'
    }
    signature = generate_signature(params, 'test_secret')
    params['signature'] = signature
    response = requests.get('https://api.example.com/user/info', params=params)
    print(f"过期时间戳请求: {response.status_code}")  # 期望403

# 测试随机数去重
def test_nonce_uniqueness():
    params = {
        'user_id': 1,
        'timestamp': int(time.time()),
        'nonce': 'same_nonce'
    }
    # 第一次请求
    signature = generate_signature(params, 'test_secret')
    params['signature'] = signature
    response1 = requests.get('https://api.example.com/user/info', params=params)
    
    # 第二次使用相同随机数
    response2 = requests.get('https://api.example.com/user/info', params=params)
    print(f"重复随机数请求: {response2.status_code}")  # 期望403