use strict;
use warnings;
use Test::More;
use Plack::Request;
use Plack::Test;
use Test::Requires 'Test::WWW::Mechanize::PSGI', 'HTTP::Session::Store::OnMemory', 'Plack::Session';
use Plack::Builder;
my $COMMIT;
{
package MyApp;
use parent qw/Amon2/;
sub load_config { +{} }
package MyApp::Web::View;
sub new {
bless {}, shift;
}
sub render {
'<!doctype html>
<html>
<form method="post" action="/do">
<input type="text" name="body" />
<input type="submit" name="post" />
</form>
</html>
'
}
package MyApp::Web;
use parent -norequire, qw/MyApp/;
use parent qw/Amon2::Web/;
use HTTP::Session::Store::OnMemory;
sub create_view { MyApp::Web::View->new() }
sub dispatch {
my $c = shift;
::like $c->get_csrf_defender_token(), qr{^[a-zA-Z0-9_]{32}$};
if ($c->req->path_info eq '/form') {
return $c->render('form.mt');
} elsif ($c->req->path_info eq '/do' && $c->req->method eq 'POST') {
$COMMIT++;
return $c->redirect('/finished');
} elsif ($c->req->path_info eq '/finished') {
return $c->create_response(200, [], ['OK']);
} elsif ($c->req->path_info eq '/get_csrf_defender_token') {
return $c->create_response(200, [], [$c->get_csrf_defender_token]);
} else {
return $c->create_response(404, [], []);
}
}
my $session = HTTP::Session::Store::OnMemory->new();
__PACKAGE__->load_plugins(
'Web::CSRFDefender' => {},
);
package MyApp::Web::HTTPSession;
our @ISA = qw/MyApp::Web/;
__PACKAGE__->load_plugins(
'Web::HTTPSession' => {
state => 'Cookie',
store => sub { $session },
},
);
package MyApp::Web::PlackSession;
our @ISA = qw/MyApp::Web/;
__PACKAGE__->load_plugins(
'Web::PlackSession' => { },
);
}
for my $klass (qw/MyApp::Web::HTTPSession MyApp::Web::PlackSession/) {
my $app = builder {
enable 'Session';
$klass->to_app;
};
subtest $klass => sub {
$COMMIT = 0;
subtest 'success case' => sub {
my $mech = Test::WWW::Mechanize::PSGI->new(
app => $app,
);
$mech->get_ok('http://localhost/form');
$mech->content_like(qr[<input type="hidden" name="csrf_token" value="[a-zA-Z0-9_]{32}" />]);
$mech->submit_form(form_number => 1, fields => {body => 'yay'});
is $mech->base, 'http://localhost/finished';
is $COMMIT, 1;
};
$COMMIT = 0;
subtest 'deny' => sub {
test_psgi
app => $app,
client => sub {
my $cb = shift;
my $res = $cb->(HTTP::Request->new(POST => 'http://localhost/do'));
is $res->code, '403';
is $COMMIT, 0;
};
};
subtest 'get_csrf_defender_token' => sub {
test_psgi
app => $app,
client => sub {
my $cb = shift;
my $res = $cb->(HTTP::Request->new(GET => 'http://localhost/get_csrf_defender_token'));
is $res->code, '200';
::like $res->content(), qr{^[a-zA-Z0-9_]{32}$};
};
};
};
}
done_testing;