specters 4.1.7

Rust HTTP client with browser-like Chrome and Firefox fingerprints across TLS, HTTP/1.1, HTTP/2, HTTP/3, and WebSockets
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74

use specter::Client;

#[path = "helpers/mock_ws_server.rs"]
mod mock_ws_server;

use mock_ws_server::{AcceptMode, MockWsServer, WsResponse};

#[tokio::test]
async fn handshake_error_preserves_original_ws_url_and_not_mapped_http_url() {
    let server = MockWsServer::new().await.unwrap();
    let url = server.ws_url("/observability?token=query-secret");
    let handle = server.start_once(WsResponse {
        accept: AcceptMode::Wrong,
        ..WsResponse::default()
    });

    let err = Client::new()
        .unwrap()
        .websocket(url.clone())
        .connect()
        .await
        .expect_err("invalid accept must fail");

    let rendered = format!("{err:?}\n{err}");
    assert!(
        rendered.contains("ws://"),
        "error should preserve original ws URL: {rendered}"
    );
    assert!(
        !rendered.contains("http://127.0.0.1"),
        "mapped http URL should not replace original ws URL: {rendered}"
    );

    let _ = handle.await.unwrap();
}

#[tokio::test]
async fn handshake_error_redacts_websocket_key_accept_and_cookie_values() {
    let server = MockWsServer::new().await.unwrap();
    let url = server.ws_url("/redaction");
    let handle = server.start_once(WsResponse {
        accept: AcceptMode::Wrong,
        ..WsResponse::default()
    });

    let err = Client::new()
        .unwrap()
        .websocket(url)
        .header("Cookie", "session=raw-cookie-secret")
        .connect()
        .await
        .expect_err("invalid accept must fail");

    let exchange = handle.await.unwrap();
    let request_key = exchange
        .request
        .header("Sec-WebSocket-Key")
        .expect("request included key")
        .to_string();
    let rendered = format!("{err:?}\n{err}");

    assert!(
        !rendered.contains(&request_key),
        "error leaked raw Sec-WebSocket-Key: {rendered}"
    );
    assert!(
        !rendered.contains("definitely-wrong"),
        "error leaked raw Sec-WebSocket-Accept: {rendered}"
    );
    assert!(
        !rendered.contains("raw-cookie-secret"),
        "error leaked raw cookie value: {rendered}"
    );
}