Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
test('fails with session and invalid token', async t => {
const Session = getSession();
const app = new App('fake-element', el => el);
app.plugin(CsrfToken, {Session});
await request(app, '/csrf-token', {method: 'POST'});
try {
await request(app, '/test', {
method: 'POST',
headers: {'x-csrf-token': 'invalid'},
});
t.fail('should fail');
} catch (e) {
t.equal(e.status, 403);
}
t.end();
});
test('does not verify ignored paths', async t => {
const Session = getSession();
const app = new App('fake-element', el => el);
const CSRF = app.plugin(CsrfToken, {Session});
CSRF.of().ignore('/test');
const ctx = await request(app, '/test', {
method: 'POST',
});
t.equal(ctx.response.status, 200);
t.end();
});
app.plugin(() => async (ctx, next) => {
const emitter = Emitter.of(ctx);
emitter.on('test-timeout', ({x, lol}) => {
t.equals(x, 1, 'payload is correct');
t.ok(lol, 'runs mappers');
flags.timeout = true;
});
setTimeout(() => {
t.ok(emitter.flushed, 'has flushed events');
emitter.emit('test-timeout', {x: 1});
t.ok(flags.timeout, 'emits events immediately after flushing');
}, 100);
return next();
});
await request(app, '/lol', {method: 'POST'});
t.ok(flags.preawait, 'flushes batch from pre-await emitted events');
t.ok(flags.postawait, 'flushes batch from post-await emitted events');
t.ok(flags.postend, 'flushes batch from post-end emitted events');
setTimeout(() => {
t.ok(flags.timeout, 'supports emitting events after batch has flushed');
t.end();
}, 150);
});
test('creates a session on a GET request', async t => {
const Session = getSession();
const app = new App('fake-element', el => el);
app.plugin(CsrfToken, {Session});
const ctx = await request(app, '/');
t.notok(
ctx.response.headers['x-csrf-token'],
'does not set x-csrf-token header'
);
t.equals(ctx.response.status, 200, 'has right status');
t.ok(Session.of(ctx).get('csrf-secret'), 'sets the session');
t.end();
});