Added more test cases, some logic fixes

Author: mebjas

libs/csrf/csrfprotector.php

@@ -65,11 +65,6 @@ function __construct($cfg) {
 
 	class csrfProtector
 	{
-		/*
-		 * application/json content type
-		 */
-		const JSONCONTENTTYPE = "application/json";
-
 		/*
 		 * Variable: $cookieExpiryTime
 		 * expiry time for cookie
@@ -94,10 +89,17 @@ class csrfProtector
 		/**
 		 * Variable: $cookieConfig
 		 * Array of parameters for the setcookie method
-		 * @var cookieConfig;
+		 * @var array<any>
 		 */
 		private static $cookieConfig = null;
 
+		/**
+		 * Variable: $tokenHeaderKey
+		 * Key value in header array, which contain the token
+		 * @var string
+		 */
+		private static $tokenHeaderKey = null;
+
 		/*
 		 * Variable: $requestType
 		 * Varaible to store weather request type is post or get
@@ -192,6 +194,9 @@ public static function init($length = null, $action = null)
 			if (self::$config['CSRFP_TOKEN'] == '')
 				self::$config['CSRFP_TOKEN'] = CSRFP_TOKEN;
 
+			self::$tokenHeaderKey = 'HTTP_' .strtoupper(self::$config['CSRFP_TOKEN']);
+			self::$tokenHeaderKey = str_replace('-', '_', self::$tokenHeaderKey);
+
 			// load parameters for setcookie method
 			if (!isset(self::$config['cookieConfig']))
 				self::$config['cookieConfig'] = array();
@@ -211,8 +216,6 @@ public static function init($length = null, $action = null)
 				}
 			}
 
-			// TODO: initialize the setcookie params, based on config;
-
 			// Authorise the incoming request
 			self::authorizePost();
 
@@ -267,7 +270,6 @@ public static function authorizePost()
 					self::refreshToken();	//refresh token for successfull validation
 				}
 			} else if (!static::isURLallowed()) {
-				
 				//currently for same origin only
 				if (!(isset($_GET[self::$config['CSRFP_TOKEN']]) 
 					&& isset($_SESSION[self::$config['CSRFP_TOKEN']])
@@ -293,7 +295,7 @@ public static function authorizePost()
 		 * any (string / bool) - token retrieved from header or form payload
 		 */
 		private static function getTokenFromRequest() {
-			// look for token in header, then in payload
+			// look for in $_POST, then header
 			if (isset($_POST[self::$config['CSRFP_TOKEN']])) {
 				return $_POST[self::$config['CSRFP_TOKEN']];
 			}
@@ -302,12 +304,11 @@ private static function getTokenFromRequest() {
 				if (isset(apache_request_headers()[self::$config['CSRFP_TOKEN']])) {
 					return apache_request_headers()[self::$config['CSRFP_TOKEN']];
 				}
-			} else {
-				$serverKey = 'HTTP_' .strtoupper(self::$config['CSRFP_TOKEN']);
-				$serverKey = str_replace('-', '_', $serverKey);
-				if (isset($_SERVER[$serverKey])) {
-					return $_SERVER[$serverKey];
-				}
+			}
+
+			if (self::$tokenHeaderKey === null) return false;
+			if (isset($_SERVER[self::$tokenHeaderKey])) {
+				return $_SERVER[self::$tokenHeaderKey];
 			}
 
 			return false;

test/csrfprotector_test.php

@@ -350,11 +350,10 @@ public function testAuthorisePost_failedAction_6()
     }
 
     /**
-     * test authorise success
+     * test authorise success with token in $_POST
      */
     public function testAuthorisePost_success()
     {
-
         $_SERVER['REQUEST_METHOD'] = 'POST';
         $_POST[csrfprotector::$config['CSRFP_TOKEN']]
             = $_GET[csrfprotector::$config['CSRFP_TOKEN']]
@@ -382,6 +381,34 @@ public function testAuthorisePost_success()
         // $this->assertTrue(csrfp_wrapper::checkHeader($_SESSION[csrfprotector::$config['CSRFP_TOKEN']][0]));  // Combine these 3 later
     }
 
+    /**
+     * test authorise success with token in header
+     */
+    public function testAuthorisePost_success_2()
+    {
+        unset($_POST[csrfprotector::$config['CSRFP_TOKEN']]);
+        $_SERVER['REQUEST_METHOD'] = 'POST';
+        $serverKey = 'HTTP_' .strtoupper(csrfprotector::$config['CSRFP_TOKEN']);
+        $serverKey = str_replace('-', '_', $serverKey);
+
+        $csrfp = new csrfProtector;
+        $reflection = new \ReflectionClass(get_class($csrfp));
+        $property = $reflection->getProperty('tokenHeaderKey');
+        $property->setAccessible(true);
+        // change value to false
+        $property->setValue($csrfp, $serverKey);
+
+        $_SERVER[$serverKey] = $_SESSION[csrfprotector::$config['CSRFP_TOKEN']][0];
+        $temp = $_SESSION[csrfprotector::$config['CSRFP_TOKEN']];
+
+        csrfprotector::authorizePost(); //will create new session and cookies
+        $this->assertFalse($temp == $_SESSION[csrfprotector::$config['CSRFP_TOKEN']][0]);
+        $this->assertTrue(csrfp_wrapper::checkHeader('Set-Cookie'));
+        $this->assertTrue(csrfp_wrapper::checkHeader('csrfp_token'));
+        // $this->assertTrue(csrfp_wrapper::checkHeader($_SESSION[csrfprotector::$config['CSRFP_TOKEN']][0]));  // Combine these 3 later
+ 
+    }
+
     /**
      * test for generateAuthToken()
      */