keith/BattleForge
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: CSRF flow ships the raw token, not the HMAC cookie

Browse Source
This commit is contained in:
Keith Solomon
2026-07-26 11:01:36 -05:00
parent 73254cbf80
commit 2ea8cfd83d
13 changed files with 60 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/Integration/PostImageUploadTest.php
+2 -2
View File
@@ -52,7 +52,7 @@ final class PostImageUploadTest extends TestCase
get: [],
post: ['_csrf' => $token],
files: ['image' => ['name' => 'a.png', 'tmp_name' => $tmp, 'error' => 0, 'size' => 70, 'type' => 'image/png']],
cookies: ['__csrf' => $cookie],
cookies: ['__csrf' => $cookie, '__csrf_token' => $token],
server: ['__csrf_secret' => self::SECRET],
queryString: '',
method: 'POST',
@@ -78,7 +78,7 @@ final class PostImageUploadTest extends TestCase
get: [],
post: ['_csrf' => $token],
files: ['image' => ['name' => 'a.png', 'tmp_name' => $tmp, 'error' => 0, 'size' => 12, 'type' => 'image/png']],
cookies: ['__csrf' => $cookie],
cookies: ['__csrf' => $cookie, '__csrf_token' => $token],
server: ['__csrf_secret' => self::SECRET],
queryString: '',
method: 'POST',