keith/BattleForge
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: CSRF flow ships the raw token, not the HMAC cookie

Browse Source
This commit is contained in:
Keith Solomon
2026-07-26 11:01:36 -05:00
parent 73254cbf80
commit 2ea8cfd83d
13 changed files with 60 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/Integration/PostMatchActionTest.php
+9 -9
View File
@@ -36,7 +36,7 @@ final class PostMatchActionTest extends TestCase
match: $match,
csrf: $csrf,
turnToken: $token,
cookies: ['__csrf' => $cookie],
cookies: ['__csrf' => $cookie, '__csrf_token' => $token],
body: [
'matchId' => self::MATCH_ID,
'match' => ScenarioSerializer::matchToArray($match),
@@ -67,7 +67,7 @@ final class PostMatchActionTest extends TestCase
match: $match,
csrf: $csrf,
turnToken: $token,
cookies: ['__csrf' => $cookie],
cookies: ['__csrf' => $cookie, '__csrf_token' => $token],
body: [
'matchId' => self::MATCH_ID,
'match' => ScenarioSerializer::matchToArray($match),
@@ -100,7 +100,7 @@ final class PostMatchActionTest extends TestCase
match: $match,
csrf: $csrf,
turnToken: $token,
cookies: ['__csrf' => $cookie],
cookies: ['__csrf' => $cookie, '__csrf_token' => $token],
body: [
'matchId' => self::MATCH_ID,
'match' => ScenarioSerializer::matchToArray($match),
@@ -135,7 +135,7 @@ final class PostMatchActionTest extends TestCase
match: $match,
csrf: $csrf,
turnToken: $token,
cookies: ['__csrf' => $cookie],
cookies: ['__csrf' => $cookie, '__csrf_token' => $token],
body: [
'matchId' => self::MATCH_ID,
'match' => ScenarioSerializer::matchToArray($match),
@@ -175,7 +175,7 @@ final class PostMatchActionTest extends TestCase
match: $match,
csrf: $csrf,
turnToken: $token,
cookies: ['__csrf' => $cookie],
cookies: ['__csrf' => $cookie, '__csrf_token' => $token],
body: [
'matchId' => self::MATCH_ID,
'match' => ScenarioSerializer::matchToArray($match),
@@ -220,7 +220,7 @@ final class PostMatchActionTest extends TestCase
match: $match,
csrf: $csrf,
turnToken: $token,
cookies: ['__csrf' => $cookie],
cookies: ['__csrf' => $cookie, '__csrf_token' => $token],
body: [
'matchId' => self::MATCH_ID,
'match' => ScenarioSerializer::matchToArray($match),
@@ -247,7 +247,7 @@ final class PostMatchActionTest extends TestCase
match: $match,
csrf: $csrf,
turnToken: $token,
cookies: ['__csrf' => $cookie],
cookies: ['__csrf' => $cookie, '__csrf_token' => $token],
body: [
'matchId' => self::MATCH_ID,
'match' => ScenarioSerializer::matchToArray($match),
@@ -275,7 +275,7 @@ final class PostMatchActionTest extends TestCase
match: $match,
csrf: $csrf,
turnToken: $stale,
cookies: ['__csrf' => $cookie],
cookies: ['__csrf' => $cookie, '__csrf_token' => $token],
body: [
'matchId' => self::MATCH_ID,
'match' => ScenarioSerializer::matchToArray($match),
@@ -292,7 +292,7 @@ final class PostMatchActionTest extends TestCase
match: $match,
csrf: $csrf,
turnToken: $wrongRound,
cookies: ['__csrf' => $cookie],
cookies: ['__csrf' => $cookie, '__csrf_token' => $token],
body: [
'matchId' => self::MATCH_ID,
'match' => ScenarioSerializer::matchToArray($match),