1# A sign-in challenge belongs to the browser that asked for it: the options2# come with a short-lived cookie the challenge is bound to, so a response3# signed over it and sent from another browser (without that cookie) is4# refused, and the same sign-in from the browser that asked works.5. "$(dirname "$0")/../lib.sh"6user dami7export FORGE_BASE_URL=https://forge.test8private_server9http -s -i -X POST -H 'Origin: https://forge.test' -d '{}' "$PRIV/login/options" | tr -d '\r' >"$T/opts"10has "$T/opts" '^Set-Cookie: __Host-forge-challenge=[A-Za-z0-9_-]{22}; Path=/; Max-Age=300; Secure; HttpOnly; SameSite=Strict$'11code=$(ssh_as dami passkey | sed -n 's/^ .*#enroll=//p')12fails_with 'HTTP 400: .*challenge' node "$T_HOME/test/authenticator.ts" enroll "$PRIV" "$code" "$T/dami.key" --other-browser13ok node "$T_HOME/test/authenticator.ts" enroll "$PRIV" "$code" "$T/dami.key"14fails_with 'HTTP 400: .*challenge' node "$T_HOME/test/authenticator.ts" login "$PRIV" "$T/dami.key" --other-browser15ok node "$T_HOME/test/authenticator.ts" login "$PRIV" "$T/dami.key"