keith/BattleForge
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: CSRF flow ships the raw token, not the HMAC cookie

Browse Source
This commit is contained in:
Keith Solomon
2026-07-26 11:01:36 -05:00
parent 73254cbf80
commit 2ea8cfd83d
13 changed files with 60 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/Integration/FullFlowTest.php
+2
View File
@@ -37,6 +37,7 @@ final class FullFlowTest extends TestCase
// Step 2: POST team editor.
$_COOKIE['__csrf'] = $cookie;
$_COOKIE['__csrf_token'] = $token;
$_SERVER['REQUEST_METHOD'] = 'POST';
$_SERVER['REQUEST_URI'] = '/scenarios/demo/edit/team';
$_SERVER['CONTENT_TYPE'] = 'application/x-www-form-urlencoded';
@@ -104,6 +105,7 @@ final class FullFlowTest extends TestCase
try {
[$token, $cookie] = CsrfToken::issue(self::SECRET);
$_COOKIE['__csrf'] = $cookie;
$_COOKIE['__csrf_token'] = $token;
$_SERVER['REQUEST_METHOD'] = 'POST';
$_SERVER['REQUEST_URI'] = '/assets/upload';
$_SERVER['CONTENT_TYPE'] = 'multipart/form-data; boundary=----test';
tests/Integration/PostBattlefieldEditorTest.php
+2 -2
View File
@@ -30,7 +30,7 @@ final class PostBattlefieldEditorTest extends TestCase
$request = $this->buildRequest(
rawBody: json_encode($this->validBattlefield(), JSON_THROW_ON_ERROR),
csrfHeader: $token,
cookies: ['__csrf' => $cookie],
cookies: ['__csrf' => $cookie, '__csrf_token' => $token],
server: ['__csrf_secret' => self::SECRET],
);
$response = $handler->handle($request, ['id' => 'demo']);
@@ -48,7 +48,7 @@ final class PostBattlefieldEditorTest extends TestCase
$request = $this->buildRequest(
rawBody: json_encode(['this' => 'is not a valid scenario'], JSON_THROW_ON_ERROR),
csrfHeader: $token,
cookies: ['__csrf' => $cookie],
cookies: ['__csrf' => $cookie, '__csrf_token' => $token],
server: ['__csrf_secret' => self::SECRET],
);
$response = $handler->handle($request, ['id' => 'demo']);
tests/Integration/PostImageUploadTest.php
+2 -2
View File
@@ -52,7 +52,7 @@ final class PostImageUploadTest extends TestCase
get: [],
post: ['_csrf' => $token],
files: ['image' => ['name' => 'a.png', 'tmp_name' => $tmp, 'error' => 0, 'size' => 70, 'type' => 'image/png']],
cookies: ['__csrf' => $cookie],
cookies: ['__csrf' => $cookie, '__csrf_token' => $token],
server: ['__csrf_secret' => self::SECRET],
queryString: '',
method: 'POST',
@@ -78,7 +78,7 @@ final class PostImageUploadTest extends TestCase
get: [],
post: ['_csrf' => $token],
files: ['image' => ['name' => 'a.png', 'tmp_name' => $tmp, 'error' => 0, 'size' => 12, 'type' => 'image/png']],
cookies: ['__csrf' => $cookie],
cookies: ['__csrf' => $cookie, '__csrf_token' => $token],
server: ['__csrf_secret' => self::SECRET],
queryString: '',
method: 'POST',
tests/Integration/PostMatchActionTest.php
+9 -9
View File
@@ -36,7 +36,7 @@ final class PostMatchActionTest extends TestCase
match: $match,
csrf: $csrf,
turnToken: $token,
cookies: ['__csrf' => $cookie],
cookies: ['__csrf' => $cookie, '__csrf_token' => $token],
body: [
'matchId' => self::MATCH_ID,
'match' => ScenarioSerializer::matchToArray($match),
@@ -67,7 +67,7 @@ final class PostMatchActionTest extends TestCase
match: $match,
csrf: $csrf,
turnToken: $token,
cookies: ['__csrf' => $cookie],
cookies: ['__csrf' => $cookie, '__csrf_token' => $token],
body: [
'matchId' => self::MATCH_ID,
'match' => ScenarioSerializer::matchToArray($match),
@@ -100,7 +100,7 @@ final class PostMatchActionTest extends TestCase
match: $match,
csrf: $csrf,
turnToken: $token,
cookies: ['__csrf' => $cookie],
cookies: ['__csrf' => $cookie, '__csrf_token' => $token],
body: [
'matchId' => self::MATCH_ID,
'match' => ScenarioSerializer::matchToArray($match),
@@ -135,7 +135,7 @@ final class PostMatchActionTest extends TestCase
match: $match,
csrf: $csrf,
turnToken: $token,
cookies: ['__csrf' => $cookie],
cookies: ['__csrf' => $cookie, '__csrf_token' => $token],
body: [
'matchId' => self::MATCH_ID,
'match' => ScenarioSerializer::matchToArray($match),
@@ -175,7 +175,7 @@ final class PostMatchActionTest extends TestCase
match: $match,
csrf: $csrf,
turnToken: $token,
cookies: ['__csrf' => $cookie],
cookies: ['__csrf' => $cookie, '__csrf_token' => $token],
body: [
'matchId' => self::MATCH_ID,
'match' => ScenarioSerializer::matchToArray($match),
@@ -220,7 +220,7 @@ final class PostMatchActionTest extends TestCase
match: $match,
csrf: $csrf,
turnToken: $token,
cookies: ['__csrf' => $cookie],
cookies: ['__csrf' => $cookie, '__csrf_token' => $token],
body: [
'matchId' => self::MATCH_ID,
'match' => ScenarioSerializer::matchToArray($match),
@@ -247,7 +247,7 @@ final class PostMatchActionTest extends TestCase
match: $match,
csrf: $csrf,
turnToken: $token,
cookies: ['__csrf' => $cookie],
cookies: ['__csrf' => $cookie, '__csrf_token' => $token],
body: [
'matchId' => self::MATCH_ID,
'match' => ScenarioSerializer::matchToArray($match),
@@ -275,7 +275,7 @@ final class PostMatchActionTest extends TestCase
match: $match,
csrf: $csrf,
turnToken: $stale,
cookies: ['__csrf' => $cookie],
cookies: ['__csrf' => $cookie, '__csrf_token' => $token],
body: [
'matchId' => self::MATCH_ID,
'match' => ScenarioSerializer::matchToArray($match),
@@ -292,7 +292,7 @@ final class PostMatchActionTest extends TestCase
match: $match,
csrf: $csrf,
turnToken: $wrongRound,
cookies: ['__csrf' => $cookie],
cookies: ['__csrf' => $cookie, '__csrf_token' => $token],
body: [
'matchId' => self::MATCH_ID,
'match' => ScenarioSerializer::matchToArray($match),
tests/Integration/PostStartMatchTest.php
+3 -3
View File
@@ -29,7 +29,7 @@ final class PostStartMatchTest extends TestCase
$request = $this->buildRequest(
rawBody: json_encode($this->validScenario(), JSON_THROW_ON_ERROR),
csrfHeader: $token,
cookies: ['__csrf' => $cookie],
cookies: ['__csrf' => $cookie, '__csrf_token' => $token],
);
$response = $handler->handle($request, ['id' => 'demo']);
@@ -51,7 +51,7 @@ final class PostStartMatchTest extends TestCase
$request = $this->buildRequest(
rawBody: json_encode(['this' => 'is not a valid scenario'], JSON_THROW_ON_ERROR),
csrfHeader: $token,
cookies: ['__csrf' => $cookie],
cookies: ['__csrf' => $cookie, '__csrf_token' => $token],
);
$response = $handler->handle($request, ['id' => 'demo']);
@@ -65,7 +65,7 @@ final class PostStartMatchTest extends TestCase
$request = $this->buildRequest(
rawBody: json_encode($this->validScenario(), JSON_THROW_ON_ERROR),
csrfHeader: $token,
cookies: ['__csrf' => $cookie],
cookies: ['__csrf' => $cookie, '__csrf_token' => $token],
);
$response = $handler->handle($request, ['id' => 'demo']);
tests/Integration/PostTeamEditorTest.php
+3 -3
View File
@@ -39,7 +39,7 @@ final class PostTeamEditorTest extends TestCase
$handler = new PostTeamEditor();
$request = $this->buildRequest(
post: $this->validPost($token),
cookies: ['__csrf' => $cookie],
cookies: ['__csrf' => $cookie, '__csrf_token' => $token],
server: ['__csrf_secret' => self::SECRET],
);
$response = $handler->handle($request, ['id' => 'demo']);
@@ -57,7 +57,7 @@ final class PostTeamEditorTest extends TestCase
$post['teamA']['units'][0]['maxHealth'] = '9999';
$request = $this->buildRequest(
post: $post,
cookies: ['__csrf' => $cookie],
cookies: ['__csrf' => $cookie, '__csrf_token' => $token],
server: ['__csrf_secret' => self::SECRET],
);
$response = $handler->handle($request, ['id' => 'demo']);
@@ -75,7 +75,7 @@ final class PostTeamEditorTest extends TestCase
$post['id'] = '</script><script>alert(1)</script>';
$request = $this->buildRequest(
post: $post,
cookies: ['__csrf' => $cookie],
cookies: ['__csrf' => $cookie, '__csrf_token' => $token],
server: ['__csrf_secret' => self::SECRET],
);
$response = $handler->handle($request, ['id' => $post['id']]);