Skip to content

Commit 56a0cfb

Browse files
akrabatakrabat
authored
Merge pull request #186 from akrabat/Accepting-Headers
Change key names so that they are valid header names
2 parents 179cbcf + 23e2c75 commit 56a0cfb

File tree

3 files changed

+59
-53
lines changed

3 files changed

+59
-53
lines changed

‎CHANGELOG.md‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,13 @@
22

33
See https://github.com/slimphp/Slim-Csrf/releases for a full list
44

5-
## Next
5+
## 2.x
6+
7+
- Fixed: The key names are now the correct format to be sent as headers.
8+
9+
This is a potential BC break. The key names now use a dash rather than an
10+
underscore. This should not affect anyone who uses the relvant methods, but
11+
if you have hard-coded, then they will need to be updated.
612

713
## 1.5.0
814

‎src/Guard.php‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@ class Guard implements MiddlewareInterface
5050
protected ResponseFactoryInterface $responseFactory;
5151

5252
/**
53-
* Prefix for CSRF parameters (omit trailing "_" underscore)
53+
* Prefix for CSRF parameters (omit trailing "-")
5454
*/
5555
protected string $prefix;
5656

@@ -122,7 +122,7 @@ public function __construct(
122122
}
123123

124124
$this->responseFactory = $responseFactory;
125-
$this->prefix = rtrim($prefix, '_');
125+
$this->prefix = rtrim($prefix, '-');
126126
$this->strength = $strength;
127127

128128
$this->setStorage($storage);
@@ -269,15 +269,15 @@ public function getTokenValue(): ?string
269269
*/
270270
public function getTokenNameKey(): string
271271
{
272-
return $this->prefix . '_name';
272+
return $this->prefix . '-name';
273273
}
274274

275275
/**
276276
* @return string
277277
*/
278278
public function getTokenValueKey(): string
279279
{
280-
return $this->prefix . '_value';
280+
return $this->prefix . '-value';
281281
}
282282

283283
/**

‎tests/GuardTest.php‎

Lines changed: 48 additions & 48 deletions
Original file line numberDiff line numberDiff line change
@@ -193,35 +193,35 @@ public function testDefaultFailureHandler()
193193
public function testValidateToken()
194194
{
195195
$storage = [
196-
'test_name' => 'value'
196+
'test-name' => 'value'
197197
];
198198
$responseFactoryProphecy = $this->prophesize(ResponseFactoryInterface::class);
199199
$mw = new Guard($responseFactoryProphecy->reveal(), 'test', $storage);
200200

201201
$maskedToken = $this->maskToken($mw, 'value');
202-
$this->assertTrue($mw->validateToken('test_name', $maskedToken));
202+
$this->assertTrue($mw->validateToken('test-name', $maskedToken));
203203

204204
$maskedToken2 = $this->maskToken($mw, 'value');
205-
$this->assertTrue($mw->validateToken('test_name', $maskedToken2));
205+
$this->assertTrue($mw->validateToken('test-name', $maskedToken2));
206206

207207
$this->assertNotSame($maskedToken, $maskedToken2);
208208
}
209209

210210
public function testNotValidatingBadToken()
211211
{
212212
$storage = [
213-
'test_name' => 'value'
213+
'test-name' => 'value'
214214
];
215215
$responseFactoryProphecy = $this->prophesize(ResponseFactoryInterface::class);
216216
$mw = new Guard($responseFactoryProphecy->reveal(), 'test', $storage);
217217

218218
$maskedToken = 'MY_BAD_BASE64???';
219-
$this->assertFalse($mw->validateToken('test_name', $maskedToken), 'Token contains bad base64 characters');
219+
$this->assertFalse($mw->validateToken('test-name', $maskedToken), 'Token contains bad base64 characters');
220220

221221
$maskedToken2 = $this->maskToken($mw, 'value');
222222
// Remove some part of base64
223223
$maskedToken2 = substr($maskedToken2, 0, -6);
224-
$this->assertFalse($mw->validateToken('test_name', $maskedToken2), 'Token size should be even');
224+
$this->assertFalse($mw->validateToken('test-name', $maskedToken2), 'Token size should be even');
225225
}
226226

227227
public function testGetTokenNameAndValue()
@@ -238,12 +238,12 @@ public function testGetTokenNameAndValue()
238238
$loadLastKeyPairMethod->invoke($mw);
239239

240240
$storage = [
241-
'test_name' => 'value',
241+
'test-name' => 'value',
242242
];
243243
$mw->setStorage($storage);
244244
$loadLastKeyPairMethod->invoke($mw);
245245

246-
$this->assertEquals('test_name', $mw->getTokenName());
246+
$this->assertEquals('test-name', $mw->getTokenName());
247247

248248
$unmaskTokenMethod = new ReflectionMethod($mw, 'unmaskToken');
249249
$unmaskTokenMethod->setAccessible(true);
@@ -266,30 +266,30 @@ public function testGetTokenNameKeyAndValue()
266266
$responseFactoryProphecy = $this->prophesize(ResponseFactoryInterface::class);
267267
$mw = new Guard($responseFactoryProphecy->reveal(), 'test', $storage);
268268

269-
$this->assertEquals('test_name', $mw->getTokenNameKey());
270-
$this->assertEquals('test_value', $mw->getTokenValueKey());
269+
$this->assertEquals('test-name', $mw->getTokenNameKey());
270+
$this->assertEquals('test-value', $mw->getTokenValueKey());
271271
}
272272

273273
public function testRemoveTokenFromStorage()
274274
{
275275
$storage = [
276-
'test_name' => 'value',
276+
'test-name' => 'value',
277277
];
278278
$responseFactoryProphecy = $this->prophesize(ResponseFactoryInterface::class);
279279
$mw = new Guard($responseFactoryProphecy->reveal(), 'test', $storage);
280280

281281
$removeTokenFromStorageMethod = new ReflectionMethod($mw, 'removeTokenFromStorage');
282282
$removeTokenFromStorageMethod->setAccessible(true);
283-
$removeTokenFromStorageMethod->invoke($mw, 'test_name');
283+
$removeTokenFromStorageMethod->invoke($mw, 'test-name');
284284

285-
$this->assertArrayNotHasKey('test_name', $storage);
285+
$this->assertArrayNotHasKey('test-name', $storage);
286286
}
287287

288288
public function testEnforceStorageLimitWithArray()
289289
{
290290
$storage = [
291-
'test_name' => 'value',
292-
'test_name2' => 'value2',
291+
'test-name' => 'value',
292+
'test-name2' => 'value2',
293293
];
294294
$responseFactoryProphecy = $this->prophesize(ResponseFactoryInterface::class);
295295
$mw = new Guard($responseFactoryProphecy->reveal(), 'test', $storage, null, 1);
@@ -298,15 +298,15 @@ public function testEnforceStorageLimitWithArray()
298298
$enforceStorageLimitMethod->setAccessible(true);
299299
$enforceStorageLimitMethod->invoke($mw);
300300

301-
$this->assertArrayNotHasKey('test_name', $storage);
302-
$this->assertArrayHasKey('test_name2', $storage);
301+
$this->assertArrayNotHasKey('test-name', $storage);
302+
$this->assertArrayHasKey('test-name2', $storage);
303303
}
304304

305305
public function testNotEnforceStorageLimitWithArrayWhenLimitIsZero()
306306
{
307307
$initial_storage = $storage = [
308-
'test_name' => 'value',
309-
'test_name2' => 'value2',
308+
'test-name' => 'value',
309+
'test-name2' => 'value2',
310310
];
311311
$responseFactoryProphecy = $this->prophesize(ResponseFactoryInterface::class);
312312
$mw = new Guard($responseFactoryProphecy->reveal(), 'test', $storage, null, 0);
@@ -321,8 +321,8 @@ public function testNotEnforceStorageLimitWithArrayWhenLimitIsZero()
321321
public function testEnforceStorageLimitWithIterator()
322322
{
323323
$storage = new ArrayIterator([
324-
'test_name' => 'value',
325-
'test_name2' => 'value',
324+
'test-name' => 'value',
325+
'test-name2' => 'value',
326326
]);
327327
$responseFactoryProphecy = $this->prophesize(ResponseFactoryInterface::class);
328328
$mw = new Guard($responseFactoryProphecy->reveal(), 'test', $storage, null, 1);
@@ -331,14 +331,14 @@ public function testEnforceStorageLimitWithIterator()
331331
$enforceStorageLimitMethod->setAccessible(true);
332332
$enforceStorageLimitMethod->invoke($mw);
333333

334-
$this->assertArrayNotHasKey('test_name', $storage);
335-
$this->assertArrayHasKey('test_name2', $storage);
334+
$this->assertArrayNotHasKey('test-name', $storage);
335+
$this->assertArrayHasKey('test-name2', $storage);
336336
}
337337

338338
public function testTokenIsRemovedFromStorageWhenPersistentModeIsOff()
339339
{
340340
$storage = [
341-
'test_name' => 'test_value123',
341+
'test-name' => 'test-value123',
342342
];
343343

344344
$responseProphecy = $this->prophesize(ResponseInterface::class)
@@ -366,21 +366,21 @@ public function testTokenIsRemovedFromStorageWhenPersistentModeIsOff()
366366
$requestProphecy
367367
->getParsedBody()
368368
->willReturn([
369-
'test_name' => 'test_name',
370-
'test_value' => $this->maskToken($mw, 'test_value123'),
369+
'test-name' => 'test-name',
370+
'test-value' => $this->maskToken($mw, 'test-value123'),
371371
])
372372
->shouldBeCalledOnce();
373373

374374

375375
$mw->process($requestProphecy->reveal(), $requestHandlerProphecy->reveal());
376-
self::assertArrayNotHasKey('test_name', $storage);
376+
self::assertArrayNotHasKey('test-name', $storage);
377377
}
378378

379379
public function testTokenIsRemovedFromStorageWhenPersistentModeIsOffOnFailure()
380380
{
381381
$storage = [
382-
'test_name' => 'test_value123',
383-
'test_name2' => 'test_value234',
382+
'test-name' => 'test-value123',
383+
'test-name2' => 'test-value234',
384384
];
385385

386386
$streamProphecy = $this->prophesize(StreamInterface::class);
@@ -429,19 +429,19 @@ public function testTokenIsRemovedFromStorageWhenPersistentModeIsOffOnFailure()
429429
$requestProphecy
430430
->getParsedBody()
431431
->willReturn([
432-
'test_name' => 'test_value123',
432+
'test-name' => 'test-value123',
433433
])
434434
->shouldBeCalledOnce();
435435

436436
$mw->process($requestProphecy->reveal(), $requestHandlerProphecy->reveal());
437437

438-
$this->assertArrayNotHasKey('test_name', $storage);
438+
$this->assertArrayNotHasKey('test-name', $storage);
439439
}
440440

441441
public function testTokenInBodyOfGetIsInvalid()
442442
{
443443
$storage = [
444-
'test_name' => 'test_value123',
444+
'test-name' => 'test-value123',
445445
];
446446

447447
// we set up a failure handler that we expect to be called because a GET cannot have a token
@@ -467,8 +467,8 @@ public function testTokenInBodyOfGetIsInvalid()
467467
$requestProphecy
468468
->getParsedBody()
469469
->willReturn([
470-
'test_name' => 'test_name',
471-
'test_value' => 'test_value123',
470+
'test-name' => 'test-name',
471+
'test-value' => 'test-value123',
472472
])
473473
->shouldBeCalledOnce();
474474

@@ -510,7 +510,7 @@ public function testProcessAppendsNewTokensWhenPersistentTokenModeIsOff()
510510
public function testProcessAppendsNewTokensWhenPersistentTokenModeIsOn()
511511
{
512512
$storage = [
513-
'test_name123' => 'test_value123',
513+
'test-name123' => 'test-value123',
514514
];
515515
$responseFactoryProphecy = $this->prophesize(ResponseFactoryInterface::class);
516516
$mw = new Guard($responseFactoryProphecy->reveal(), 'test', $storage, null, 200, 16, true);
@@ -526,12 +526,12 @@ public function testProcessAppendsNewTokensWhenPersistentTokenModeIsOn()
526526
->shouldBeCalledOnce();
527527

528528
$requestProphecy
529-
->withAttribute('test_name', 'test_name123')
529+
->withAttribute('test-name', 'test-name123')
530530
->willReturn($requestProphecy->reveal())
531531
->shouldBeCalledOnce();
532532

533533
$requestProphecy
534-
->withAttribute('test_value', Argument::type('string'))
534+
->withAttribute('test-value', Argument::type('string'))
535535
->willReturn($requestProphecy->reveal())
536536
->shouldBeCalledOnce();
537537

@@ -548,8 +548,8 @@ public function testProcessAppendsNewTokensWhenPersistentTokenModeIsOn()
548548
public function testCanGetLastKeyPairFromIterator()
549549
{
550550
$storage = new ArrayIterator([
551-
'test_key1' => 'value1',
552-
'test_key2' => 'value2',
551+
'test-key1' => 'value1',
552+
'test-key2' => 'value2',
553553
]);
554554
$responseFactoryProphecy = $this->prophesize(ResponseFactoryInterface::class);
555555
$mw = new Guard($responseFactoryProphecy->reveal(), 'test', $storage, null, 1);
@@ -559,20 +559,20 @@ public function testCanGetLastKeyPairFromIterator()
559559
$keyPair = $enforceStorageLimitMethod->invoke($mw);
560560

561561
$this->assertIsArray($keyPair);
562-
$this->assertArrayHasKey('test_name', $keyPair);
563-
$this->assertArrayHasKey('test_value', $keyPair);
564-
$this->assertEquals('test_key2', $keyPair['test_name']);
562+
$this->assertArrayHasKey('test-name', $keyPair);
563+
$this->assertArrayHasKey('test-value', $keyPair);
564+
$this->assertEquals('test-key2', $keyPair['test-name']);
565565

566566
$unmaskTokenMethod = new ReflectionMethod($mw, 'unmaskToken');
567567
$unmaskTokenMethod->setAccessible(true);
568-
$unmaskedToken = $unmaskTokenMethod->invoke($mw, $keyPair['test_value']);
568+
$unmaskedToken = $unmaskTokenMethod->invoke($mw, $keyPair['test-value']);
569569
$this->assertEquals('value2', $unmaskedToken);
570570
}
571571

572572
public function testTokenFromHeaderOnDelete()
573573
{
574574
$storage = [
575-
'test_name' => 'test_value123',
575+
'test-name' => 'test-value123',
576576
];
577577

578578
$responseProphecy = $this->prophesize(ResponseInterface::class)
@@ -602,12 +602,12 @@ public function testTokenFromHeaderOnDelete()
602602
->willReturn([])
603603
->shouldBeCalledOnce();
604604
$requestProphecy
605-
->getHeader('test_name')
606-
->willReturn(['test_name'])
605+
->getHeader('test-name')
606+
->willReturn(['test-name'])
607607
->shouldBeCalledOnce();
608608
$requestProphecy
609-
->getHeader('test_value')
610-
->willReturn([$this->maskToken($mw, 'test_value123')])
609+
->getHeader('test-value')
610+
->willReturn([$this->maskToken($mw, 'test-value123')])
611611
->shouldBeCalledOnce();
612612

613613
$mw->process($requestProphecy->reveal(), $requestHandlerProphecy->reveal());

0 commit comments

Comments
 (0)