sneak/pixa
1
0
Fork 0
Code Issues 55 Pull Requests 4 Actions Packages Projects Releases Wiki Activity

test: CSRF rejection/acceptance for POST / and POST /generate

Browse Source 
Failing tests (TDD) for the two cookie-authenticated HTML form posts:
a POST without a CSRF token is rejected, a token that does not match the
request's CSRF cookie is rejected, and a matching cookie+token succeeds.
Login CSRF is covered specifically: the POST / cases carry no session,
so protection rests on a token bound to a pre-session cookie.

These reference production symbols not yet added (newCSRFProtect,
Handlers.CSRF, the csrfProtect field), so the package does not build
until the implementation lands.

model: claude-opus-4-8
This commit is contained in:
sneak
2026-09-21 07:31:32 +00:00
parent 2d805125ee
commit b5452d744d
3 changed files with 267 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
go.mod
+1
View File
@@ -71,6 +71,7 @@ require (
github.com/google/uuid v1.6.0 // indirect
github.com/googleapis/enterprise-certificate-proxy v0.3.6 // indirect
github.com/googleapis/gax-go/v2 v2.14.2 // indirect
github.com/gorilla/csrf v1.7.3 // indirect
github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3 // indirect
github.com/hashicorp/consul/api v1.32.1 // indirect
github.com/hashicorp/errwrap v1.1.0 // indirect