Fix catch JsonDecode exception aswell

Author: NeoIsRecursive

packages/http/src/Session/VerifyCsrfMiddleware.php

@@ -17,6 +17,7 @@
 use Tempest\Http\Session\Session;
 use Tempest\Router\HttpMiddleware;
 use Tempest\Router\HttpMiddlewareCallable;
+use Tempest\Support\Json\Exception\JsonCouldNotBeDecoded;
 use Tempest\Support\Str;
 
 #[Priority(Priority::FRAMEWORK)]
@@ -77,7 +78,7 @@ private function ensureTokenMatches(Request $request): void
                 $tokenFromRequest = $this->encrypter->decrypt(
                     urldecode($request->headers->get(self::CSRF_HEADER_KEY)),
                 );
-            } catch (EncryptionException) {
+            } catch (EncryptionException|JsonCouldNotBeDecoded) {
                 throw new CsrfTokenDidNotMatch();
             }
         }

tests/Integration/Http/CsrfTest.php

@@ -101,6 +101,19 @@ public function test_matches_from_header_when_encrypted(): void
             ->assertOk();
     }
 
+    public function test_throws_csrf_exception_when_header_is_non_serialized_hash(): void
+    {
+        $this->expectException(CsrfTokenDidNotMatch::class);
+        $this->container->get(AppConfig::class)->environment = Environment::PRODUCTION;
+        $session = $this->container->get(Session::class);
+
+        // simulate a non-serialized hash
+        $sessionCookieValue = 'i-am-not-correct';
+
+        $this->http
+            ->post('/test', headers: [VerifyCsrfMiddleware::CSRF_HEADER_KEY => $sessionCookieValue]);
+    }
+
     public function test_csrf_component(): void
     {
         $session = $this->container->get(Session::class);