From d133ea40e48d3d6d1d8c55a79fe9c97cb051bcca Mon Sep 17 00:00:00 2001 From: Hamid Malek Mohammadi Date: Sat, 3 Oct 2026 14:15:04 +0330 Subject: [PATCH] test(session): ensure token tampering test always modifies token Replace hardcoded 'X' with conditional 'X'/'Y' to guarantee the tampered token differs from the original when the character at position len(token)-5 happens to be 'X'. --- v2/session/session_test.go | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/v2/session/session_test.go b/v2/session/session_test.go index 64373a7..0f6aa55 100644 --- a/v2/session/session_test.go +++ b/v2/session/session_test.go @@ -592,8 +592,13 @@ func TestCookieStore_EncryptionTamperedToken(t *testing.T) { t.Fatalf("Save: %v", err) } - // Tamper with the token by flipping a character. - tampered := token[:len(token)-5] + "X" + token[len(token)-4:] + // Tamper with the token by replacing a character. The replacement must + // differ from the original character, otherwise the token is unchanged. + replacement := "X" + if token[len(token)-5] == 'X' { + replacement = "Y" + } + tampered := token[:len(token)-5] + replacement + token[len(token)-4:] _, err = store.Load(context.Background(), tampered) if err == nil { t.Fatal("expected error loading tampered encrypted token")