go/echo
1
0
Fork 0
mirror of https://github.com/labstack/echo.git synced 2025-07-05 00:58:47 +02:00
Code Issues Releases Activity

Fixed #597 (#598)

Browse Source 
Signed-off-by: Vishal Rana <vr@labstack.com>
This commit is contained in:
Vishal Rana
2016-07-13 16:55:46 -07:00
committed by GitHub
parent 451b2ccc9f
commit 98d744b8fb
2 changed files with 39 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
middleware/csrf_test.go
View File

@ -17,9 +17,7 @@ func TestCSRF(t *testing.T) {
rec := test.NewResponseRecorder()
c := e.NewContext(req, rec)
csrf := CSRFWithConfig(CSRFConfig{
Secret: []byte("secret"),
CookiePath: "/",
CookieDomain: "labstack.com",
Secret: []byte("secret"),
})
h := csrf(func(c echo.Context) error {
return c.String(http.StatusOK, "test")
@ -32,19 +30,25 @@ func TestCSRF(t *testing.T) {
// Generate CSRF token
h(c)
assert.Contains(t, rec.Header().Get(echo.HeaderSetCookie), "csrf")
assert.Contains(t, rec.Header().Get(echo.HeaderSetCookie), "_csrf")
// Without CSRF cookie
req = test.NewRequest(echo.POST, "/", nil)
rec = test.NewResponseRecorder()
c = e.NewContext(req, rec)
assert.Error(t, h(c))
// Empty/invalid CSRF token
req = test.NewRequest(echo.POST, "/", nil)
rec = test.NewResponseRecorder()
c = e.NewContext(req, rec)
req.Header().Set(echo.HeaderXCSRFToken, "")
he := h(c).(*echo.HTTPError)
assert.Equal(t, http.StatusForbidden, he.Code)
assert.Error(t, h(c))
// Valid CSRF token
salt, _ := generateSalt(8)
token := generateCSRFToken([]byte("secret"), salt)
req.Header().Set(echo.HeaderCookie, "_csrf="+token)
req.Header().Set(echo.HeaderXCSRFToken, token)
if assert.NoError(t, h(c)) {
assert.Equal(t, http.StatusOK, rec.Status())