From d4633362063f1e3554b2fb38886a2e597d3f9990 Mon Sep 17 00:00:00 2001 From: Meta Vens Date: Sun, 11 Oct 2026 22:41:31 +0200 Subject: [PATCH] Heimdall tests: a genuine attempt cookie under a name that is no slot is no attempt Co-Authored-By: Claude Sonnet 5.5 --- tests/Bifrost.Web.Tests/HeimdallCompletionTests.cs | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/tests/Bifrost.Web.Tests/HeimdallCompletionTests.cs b/tests/Bifrost.Web.Tests/HeimdallCompletionTests.cs index 1d1586b..d49061d 100644 --- a/tests/Bifrost.Web.Tests/HeimdallCompletionTests.cs +++ b/tests/Bifrost.Web.Tests/HeimdallCompletionTests.cs @@ -449,6 +449,11 @@ public sealed class HeimdallCompletionTests Assert.False(refused.Response.Headers.Contains("Set-Cookie"), name); } + // A genuine cookie value under a name that is no slot is no attempt either: request input never names a slot. + var offRing = await host.CompleteAsync(attempt.Nonce, code, attempt.Cookie, HeimdallAttemptCookie.Prefix + "9"); + AssertRefusedRedirect(offRing); + Assert.False(offRing.Response.Headers.Contains("Set-Cookie")); + Assert.Equal(0, host.Heimdall.RedeemCalls); Assert.Null(await host.Account(accountId));