keith/BattleForge
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: CSRF flow ships the raw token, not the HMAC cookie

Browse Source
This commit is contained in:
Keith Solomon
2026-07-26 11:01:36 -05:00
parent 73254cbf80
commit 2ea8cfd83d
13 changed files with 60 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/Integration/PostTeamEditorTest.php
+3 -3
View File
@@ -39,7 +39,7 @@ final class PostTeamEditorTest extends TestCase
$handler = new PostTeamEditor();
$request = $this->buildRequest(
post: $this->validPost($token),
cookies: ['__csrf' => $cookie],
cookies: ['__csrf' => $cookie, '__csrf_token' => $token],
server: ['__csrf_secret' => self::SECRET],
);
$response = $handler->handle($request, ['id' => 'demo']);
@@ -57,7 +57,7 @@ final class PostTeamEditorTest extends TestCase
$post['teamA']['units'][0]['maxHealth'] = '9999';
$request = $this->buildRequest(
post: $post,
cookies: ['__csrf' => $cookie],
cookies: ['__csrf' => $cookie, '__csrf_token' => $token],
server: ['__csrf_secret' => self::SECRET],
);
$response = $handler->handle($request, ['id' => 'demo']);
@@ -75,7 +75,7 @@ final class PostTeamEditorTest extends TestCase
$post['id'] = '</script><script>alert(1)</script>';
$request = $this->buildRequest(
post: $post,
cookies: ['__csrf' => $cookie],
cookies: ['__csrf' => $cookie, '__csrf_token' => $token],
server: ['__csrf_secret' => self::SECRET],
);
$response = $handler->handle($request, ['id' => $post['id']]);