Update tests to bypass antiforgery via BypassAntiforgeryValidation environment; modify AntiforgeryMiddleware to disable check when set

Author: tjementum

application/account-management/Tests/EndpointBaseTest.cs

@@ -105,6 +105,10 @@ protected EndpointBaseTest()
         var memberAccessToken = AccessTokenGenerator.Generate(DatabaseSeeder.Tenant1Member.Adapt<UserInfo>());
         AuthenticatedMemberHttpClient = _webApplicationFactory.CreateClient();
         AuthenticatedMemberHttpClient.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", memberAccessToken);
+
+        // Set the environment variable to bypass antiforgery validation on the server. ASP.NET uses a cryptographic
+        // double-submit pattern that encrypts the user's ClaimUid in the token, which is complex to replicate in tests
+        Environment.SetEnvironmentVariable("BypassAntiforgeryValidation", "true");
     }
 
     protected SqliteConnection Connection { get; }

application/back-office/Tests/EndpointBaseTest.cs

@@ -105,6 +105,10 @@ protected EndpointBaseTest()
         var memberAccessToken = AccessTokenGenerator.Generate(DatabaseSeeder.Tenant1Member.Adapt<UserInfo>());
         AuthenticatedMemberHttpClient = _webApplicationFactory.CreateClient();
         AuthenticatedMemberHttpClient.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", memberAccessToken);
+
+        // Set the environment variable to bypass antiforgery validation on the server. ASP.NET uses a cryptographic
+        // double-submit pattern that encrypts the user's ClaimUid in the token, which is complex to replicate in tests
+        Environment.SetEnvironmentVariable("BypassAntiforgeryValidation", "true");
     }
 
     protected SqliteConnection Connection { get; }

application/shared-kernel/SharedKernel/Antiforgery/AntiforgeryMiddleware.cs

@@ -14,6 +14,13 @@ public async Task InvokeAsync(HttpContext context, RequestDelegate next)
             return;
         }
 
+        if (bool.TryParse(Environment.GetEnvironmentVariable("BypassAntiforgeryValidation"), out _))
+        {
+            logger.LogDebug("Bypassing antiforgery validation due to environment variable setting");
+            await next(context);
+            return;
+        }
+
         if (!await antiforgery.IsRequestValidAsync(context))
         {
             var traceId = Activity.Current?.Id ?? context.TraceIdentifier;