CsrfTokenClearingLogoutHandlerTest.php 3.4 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576
  1. <?php
  2. /*
  3. * This file is part of the Symfony package.
  4. *
  5. * (c) Fabien Potencier <fabien@symfony.com>
  6. *
  7. * For the full copyright and license information, please view the LICENSE
  8. * file that was distributed with this source code.
  9. */
  10. namespace Symfony\Component\Security\Http\Tests\Logout;
  11. use PHPUnit\Framework\TestCase;
  12. use Symfony\Component\HttpFoundation\Request;
  13. use Symfony\Component\HttpFoundation\Response;
  14. use Symfony\Component\HttpFoundation\Session\Session;
  15. use Symfony\Component\HttpFoundation\Session\Storage\MockArraySessionStorage;
  16. use Symfony\Component\Security\Csrf\TokenStorage\SessionTokenStorage;
  17. use Symfony\Component\Security\Http\Logout\CsrfTokenClearingLogoutHandler;
  18. class CsrfTokenClearingLogoutHandlerTest extends TestCase
  19. {
  20. private $session;
  21. private $csrfTokenStorage;
  22. private $csrfTokenClearingLogoutHandler;
  23. protected function setUp()
  24. {
  25. $this->session = new Session(new MockArraySessionStorage());
  26. $this->csrfTokenStorage = new SessionTokenStorage($this->session, 'foo');
  27. $this->csrfTokenStorage->setToken('foo', 'bar');
  28. $this->csrfTokenStorage->setToken('foobar', 'baz');
  29. $this->csrfTokenClearingLogoutHandler = new CsrfTokenClearingLogoutHandler($this->csrfTokenStorage);
  30. }
  31. public function testCsrfTokenCookieWithSameNamespaceIsRemoved()
  32. {
  33. $this->assertSame('bar', $this->session->get('foo/foo'));
  34. $this->assertSame('baz', $this->session->get('foo/foobar'));
  35. $this->csrfTokenClearingLogoutHandler->logout(new Request(), new Response(), $this->getMockBuilder('Symfony\Component\Security\Core\Authentication\Token\TokenInterface')->getMock());
  36. $this->assertFalse($this->csrfTokenStorage->hasToken('foo'));
  37. $this->assertFalse($this->csrfTokenStorage->hasToken('foobar'));
  38. $this->assertFalse($this->session->has('foo/foo'));
  39. $this->assertFalse($this->session->has('foo/foobar'));
  40. }
  41. public function testCsrfTokenCookieWithDifferentNamespaceIsNotRemoved()
  42. {
  43. $barNamespaceCsrfSessionStorage = new SessionTokenStorage($this->session, 'bar');
  44. $barNamespaceCsrfSessionStorage->setToken('foo', 'bar');
  45. $barNamespaceCsrfSessionStorage->setToken('foobar', 'baz');
  46. $this->assertSame('bar', $this->session->get('foo/foo'));
  47. $this->assertSame('baz', $this->session->get('foo/foobar'));
  48. $this->assertSame('bar', $this->session->get('bar/foo'));
  49. $this->assertSame('baz', $this->session->get('bar/foobar'));
  50. $this->csrfTokenClearingLogoutHandler->logout(new Request(), new Response(), $this->getMockBuilder('Symfony\Component\Security\Core\Authentication\Token\TokenInterface')->getMock());
  51. $this->assertTrue($barNamespaceCsrfSessionStorage->hasToken('foo'));
  52. $this->assertTrue($barNamespaceCsrfSessionStorage->hasToken('foobar'));
  53. $this->assertSame('bar', $barNamespaceCsrfSessionStorage->getToken('foo'));
  54. $this->assertSame('baz', $barNamespaceCsrfSessionStorage->getToken('foobar'));
  55. $this->assertFalse($this->csrfTokenStorage->hasToken('foo'));
  56. $this->assertFalse($this->csrfTokenStorage->hasToken('foobar'));
  57. $this->assertFalse($this->session->has('foo/foo'));
  58. $this->assertFalse($this->session->has('foo/foobar'));
  59. $this->assertSame('bar', $this->session->get('bar/foo'));
  60. $this->assertSame('baz', $this->session->get('bar/foobar'));
  61. }
  62. }