From 78c03e157bf1cef1637b3445367715f62d4bd896 Mon Sep 17 00:00:00 2001 From: xiaoxia Date: Thu, 23 Jul 2026 19:42:47 +0800 Subject: [PATCH] =?UTF-8?q?fix(test):=20=E4=BF=AE=E5=A4=8DJWT=E7=AF=A1?= =?UTF-8?q?=E6=94=B9=E7=AD=BE=E5=90=8D=E6=B5=8B=E8=AF=95flaky=20-=20?= =?UTF-8?q?=E6=94=B9=E7=AD=BE=E5=90=8D=E4=B8=AD=E9=97=B4=E5=AD=97=E7=AC=A6?= =?UTF-8?q?=E8=80=8C=E9=9D=9E=E6=9C=80=E5=90=8E=E4=B8=80=E4=BD=8D?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- tests/unit/test_auth_service.py | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/tests/unit/test_auth_service.py b/tests/unit/test_auth_service.py index 42d1c64bc..5e5464a3c 100755 --- a/tests/unit/test_auth_service.py +++ b/tests/unit/test_auth_service.py @@ -458,8 +458,15 @@ class TestJWTService: def test_verify_token_tampered_signature(self, service): """篡改签名的token无法验证""" token = service.create_access_token(user_id="user_123") - # 篡改最后一个字符 - tampered = token[:-1] + ("A" if token[-1] != "A" else "B") + # 篡改签名部分中间的字符（JWT格式: header.payload.signature） + # 改最后一个字符不可靠（可能是padding），改签名中间确保验证失败 + parts = token.rsplit(".", 1) + assert len(parts) == 2, "JWT格式不对，应该有两个点分隔三部分" + signature = parts[1] + # 篡改签名中间的几个字符 + mid = len(signature) // 2 + tampered_sig = signature[:mid] + ("X" if signature[mid] != "X" else "Y") + signature[mid + 1 :] + tampered = parts[0] + "." + tampered_sig with pytest.raises(InvalidTokenError): service.verify_token(tampered) -- 2.54.0