mirror of
https://github.com/sinatra/sinatra
synced 2023-03-27 23:18:01 -04:00
4f1bdba0c5
Rack::Protection::AuthenticityToken.token(session) can now make sure that an authenticity token is set in the session before returning a masked version of the token. Any Rack app that shares the session can use this method when building a form for an app that uses rack-protection. Removes references to Rails compatibility as rack-protection 2.0 officially breaks that promise.
57 lines
2.4 KiB
Ruby
57 lines
2.4 KiB
Ruby
describe Rack::Protection::RemoteToken do
|
|
let(:token) { described_class.random_token }
|
|
let(:masked_token) { described_class.token(session) }
|
|
let(:bad_token) { Base64.strict_encode64("badtoken") }
|
|
let(:session) { {:csrf => token} }
|
|
|
|
it_behaves_like "any rack application"
|
|
|
|
it "accepts post requests with no referrer" do
|
|
expect(post('/')).to be_ok
|
|
end
|
|
|
|
it "accepts post requests with a local referrer" do
|
|
expect(post('/', {}, 'HTTP_REFERER' => '/')).to be_ok
|
|
end
|
|
|
|
it "denies post requests with a remote referrer and no token" do
|
|
post('/', {}, 'HTTP_REFERER' => 'http://example.com/foo', 'HTTP_HOST' => 'example.org')
|
|
expect(last_response).not_to be_ok
|
|
end
|
|
|
|
it "accepts post requests with a remote referrer and correct X-CSRF-Token header" do
|
|
post('/', {}, 'HTTP_REFERER' => 'http://example.com/foo', 'HTTP_HOST' => 'example.org',
|
|
'rack.session' => session, 'HTTP_X_CSRF_TOKEN' => token)
|
|
expect(last_response).to be_ok
|
|
end
|
|
|
|
it "accepts post requests with a remote referrer and masked X-CSRF-Token header" do
|
|
post('/', {}, 'HTTP_REFERER' => 'http://example.com/foo', 'HTTP_HOST' => 'example.org',
|
|
'rack.session' => session, 'HTTP_X_CSRF_TOKEN' => masked_token)
|
|
expect(last_response).to be_ok
|
|
end
|
|
|
|
it "denies post requests with a remote referrer and wrong X-CSRF-Token header" do
|
|
post('/', {}, 'HTTP_REFERER' => 'http://example.com/foo', 'HTTP_HOST' => 'example.org',
|
|
'rack.session' => session, 'HTTP_X_CSRF_TOKEN' => bad_token)
|
|
expect(last_response).not_to be_ok
|
|
end
|
|
|
|
it "accepts post form requests with a remote referrer and correct authenticity_token field" do
|
|
post('/', {"authenticity_token" => token}, 'HTTP_REFERER' => 'http://example.com/foo',
|
|
'HTTP_HOST' => 'example.org', 'rack.session' => session)
|
|
expect(last_response).to be_ok
|
|
end
|
|
|
|
it "accepts post form requests with a remote referrer and masked authenticity_token field" do
|
|
post('/', {"authenticity_token" => masked_token}, 'HTTP_REFERER' => 'http://example.com/foo',
|
|
'HTTP_HOST' => 'example.org', 'rack.session' => session)
|
|
expect(last_response).to be_ok
|
|
end
|
|
|
|
it "denies post form requests with a remote referrer and wrong authenticity_token field" do
|
|
post('/', {"authenticity_token" => bad_token}, 'HTTP_REFERER' => 'http://example.com/foo',
|
|
'HTTP_HOST' => 'example.org', 'rack.session' => session)
|
|
expect(last_response).not_to be_ok
|
|
end
|
|
end
|