61 lines
1.7 KiB
PHP
61 lines
1.7 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace BattleForge\Tests\Unit\Http;
|
|
|
|
use BattleForge\Http\CsrfToken;
|
|
use PHPUnit\Framework\TestCase;
|
|
|
|
final class CsrfTokenTest extends TestCase
|
|
{
|
|
private const SECRET = 'unit-test-secret';
|
|
|
|
public function testIssueReturnsTokenAndCookieValue(): void
|
|
{
|
|
[$token, $cookie] = CsrfToken::issue(self::SECRET);
|
|
|
|
self::assertNotSame('', $token);
|
|
self::assertNotSame('', $cookie);
|
|
self::assertSame(64, strlen($token));
|
|
}
|
|
|
|
public function testVerifyAcceptsAValidPair(): void
|
|
{
|
|
[$token, $cookie] = CsrfToken::issue(self::SECRET);
|
|
|
|
self::assertTrue(CsrfToken::verify($token, self::SECRET, $cookie));
|
|
}
|
|
|
|
public function testVerifyRejectsATamperedCookieValue(): void
|
|
{
|
|
[$token] = CsrfToken::issue(self::SECRET);
|
|
|
|
self::assertFalse(CsrfToken::verify($token, self::SECRET, 'not-the-cookie'));
|
|
}
|
|
|
|
public function testVerifyRejectsATamperedToken(): void
|
|
{
|
|
[, $cookie] = CsrfToken::issue(self::SECRET);
|
|
|
|
self::assertFalse(CsrfToken::verify('not-the-token', self::SECRET, $cookie));
|
|
}
|
|
|
|
public function testIssueProducesDifferentTokensAcrossCalls(): void
|
|
{
|
|
[$tokenA] = CsrfToken::issue(self::SECRET);
|
|
[$tokenB] = CsrfToken::issue(self::SECRET);
|
|
|
|
self::assertNotSame($tokenA, $tokenB);
|
|
}
|
|
|
|
public function testDifferentSecretsProduceDifferentCookieValues(): void
|
|
{
|
|
[$tokenA, $cookieA] = CsrfToken::issue('secret-a');
|
|
[, $cookieB] = CsrfToken::issue('secret-b');
|
|
|
|
self::assertTrue(CsrfToken::verify($tokenA, 'secret-a', $cookieA));
|
|
self::assertFalse(CsrfToken::verify($tokenA, 'secret-b', $cookieB));
|
|
}
|
|
}
|