59 lines
1.4 KiB
PHP
59 lines
1.4 KiB
PHP
<?php
|
|
|
|
namespace Bazaar\Tests;
|
|
|
|
use Bazaar\Core\Csrf;
|
|
use Bazaar\Core\Session;
|
|
use PHPUnit\Framework\TestCase;
|
|
|
|
final class CsrfTest extends TestCase
|
|
{
|
|
private Csrf $csrf;
|
|
|
|
protected function setUp(): void
|
|
{
|
|
$_SESSION = [];
|
|
$this->csrf = new Csrf(new Session());
|
|
}
|
|
|
|
public function testTokenIsStableWithinASession(): void
|
|
{
|
|
$this->assertSame($this->csrf->token(), $this->csrf->token());
|
|
}
|
|
|
|
public function testVerifyAcceptsTheIssuedToken(): void
|
|
{
|
|
$token = $this->csrf->token();
|
|
|
|
$this->assertTrue($this->csrf->verify($token));
|
|
}
|
|
|
|
public function testVerifyRejectsAWrongToken(): void
|
|
{
|
|
$this->csrf->token();
|
|
|
|
$this->assertFalse($this->csrf->verify('forged-token'));
|
|
}
|
|
|
|
public function testVerifyRejectsEmptyAndNull(): void
|
|
{
|
|
$this->csrf->token();
|
|
|
|
$this->assertFalse($this->csrf->verify(''));
|
|
$this->assertFalse($this->csrf->verify(null));
|
|
}
|
|
|
|
public function testVerifyFailsWhenNoTokenWasIssued(): void
|
|
{
|
|
$this->assertFalse($this->csrf->verify('anything'));
|
|
}
|
|
|
|
public function testFieldEmbedsTheToken(): void
|
|
{
|
|
$token = $this->csrf->token();
|
|
|
|
$this->assertStringContainsString($token, $this->csrf->field());
|
|
$this->assertStringContainsString('name="csrfToken"', $this->csrf->field());
|
|
}
|
|
}
|