Function TestCSRFConfig_checkSecFetchSiteRequest

middleware/csrf_test.go:527–875

(t *testing.T)

}

func TestCSRFConfig_checkSecFetchSiteRequest(t *testing.T) {
	var testCases = []struct {
		name             string
		givenConfig      CSRFConfig
		whenMethod       string
		whenSecFetchSite string
		whenOrigin       string
		expectAllow      bool
		expectErr        string
	}{
		{
			name:             "ok, unsafe POST, no SecFetchSite is not blocked",
			givenConfig:      CSRFConfig{},
			whenMethod:       http.MethodPost,
			whenSecFetchSite: "",
			expectAllow:      false, // should fall back to token CSRF
		},
		{
			name:             "ok, safe GET + same-origin passes",
			givenConfig:      CSRFConfig{},
			whenMethod:       http.MethodGet,
			whenSecFetchSite: "same-origin",
			expectAllow:      true,
		},
		{
			name:             "ok, safe GET + none passes",
			givenConfig:      CSRFConfig{},
			whenMethod:       http.MethodGet,
			whenSecFetchSite: "none",
			expectAllow:      true,
		},
		{
			name:             "ok, safe GET + same-site passes",
			givenConfig:      CSRFConfig{},
			whenMethod:       http.MethodGet,
			whenSecFetchSite: "same-site",
			expectAllow:      true,
		},
		{
			name:             "ok, safe GET + cross-site passes",
			givenConfig:      CSRFConfig{},
			whenMethod:       http.MethodGet,
			whenSecFetchSite: "cross-site",
			expectAllow:      true,
		},
		{
			name:             "nok, unsafe POST + cross-site is blocked",
			givenConfig:      CSRFConfig{},
			whenMethod:       http.MethodPost,
			whenSecFetchSite: "cross-site",
			expectAllow:      false,
			expectErr:        `code=403, message=cross-site request blocked by CSRF`,
		},
		{
			name:             "nok, unsafe POST + same-site is blocked",
			givenConfig:      CSRFConfig{},
			whenMethod:       http.MethodPost,
			whenSecFetchSite: "same-site",