29 lines
1.1 KiB
TypeScript
29 lines
1.1 KiB
TypeScript
import { test, expect } from "bun:test";
|
|
import { createContext, csrfToken, verifyCsrf, CSRF_COOKIE } from "../src/index.ts";
|
|
|
|
function ctx(method: string, cookie?: string, header?: string) {
|
|
const headers: Record<string, string> = {};
|
|
if (cookie) headers.cookie = `${CSRF_COOKIE}=${cookie}`;
|
|
if (header) headers["x-csrf-token"] = header;
|
|
const req = new Request("http://x/api", { method, headers });
|
|
return createContext(req, new URL(req.url));
|
|
}
|
|
|
|
test("csrfToken issues a token", () => {
|
|
const token = csrfToken(ctx("GET"));
|
|
expect(token).toBeTruthy();
|
|
expect(token.length).toBeGreaterThan(16);
|
|
});
|
|
|
|
test("verifyCsrf: safe methods always pass", () => {
|
|
expect(verifyCsrf(ctx("GET"))).toBe(true);
|
|
expect(verifyCsrf(ctx("HEAD"))).toBe(true);
|
|
});
|
|
|
|
test("verifyCsrf: unsafe methods need matching cookie + header", () => {
|
|
expect(verifyCsrf(ctx("POST", "abc", "abc"))).toBe(true);
|
|
expect(verifyCsrf(ctx("POST", "abc", "xyz"))).toBe(false); // mismatch
|
|
expect(verifyCsrf(ctx("POST", "abc"))).toBe(false); // no header
|
|
expect(verifyCsrf(ctx("POST", undefined, "abc"))).toBe(false); // no cookie
|
|
});
|