diff options
author | Jeffrey Guenther <guenther.jeffrey@gmail.com> | 2017-12-08 13:25:54 -0800 |
---|---|---|
committer | Jeffrey Guenther <guenther.jeffrey@gmail.com> | 2017-12-08 13:25:54 -0800 |
commit | a822287cefc38b9b8b3be38ffd775cd3d511b7c3 (patch) | |
tree | d69c6ea1fcc4299caa11bcbef2ce5520347a4f46 /actionpack/test/controller/request_forgery_protection_test.rb | |
parent | 08fab27db52aa375df85a23e89799600f785b9d4 (diff) | |
parent | da8e0ba03cbae33857954c0c1a228bd6dae562da (diff) | |
download | rails-a822287cefc38b9b8b3be38ffd775cd3d511b7c3.tar.gz rails-a822287cefc38b9b8b3be38ffd775cd3d511b7c3.tar.bz2 rails-a822287cefc38b9b8b3be38ffd775cd3d511b7c3.zip |
Merge branch 'master' into activestorage-guide
Diffstat (limited to 'actionpack/test/controller/request_forgery_protection_test.rb')
-rw-r--r-- | actionpack/test/controller/request_forgery_protection_test.rb | 13 |
1 files changed, 13 insertions, 0 deletions
diff --git a/actionpack/test/controller/request_forgery_protection_test.rb b/actionpack/test/controller/request_forgery_protection_test.rb index eb3d2f34a8..4822d85bcb 100644 --- a/actionpack/test/controller/request_forgery_protection_test.rb +++ b/actionpack/test/controller/request_forgery_protection_test.rb @@ -446,6 +446,19 @@ module RequestForgeryProtectionTests end end + def test_should_raise_for_post_with_null_origin + forgery_protection_origin_check do + session[:_csrf_token] = @token + @controller.stub :form_authenticity_token, @token do + exception = assert_raises(ActionController::InvalidAuthenticityToken) do + @request.set_header "HTTP_ORIGIN", "null" + post :index, params: { custom_authenticity_token: @token } + end + assert_match "The browser returned a 'null' origin for a request", exception.message + end + end + end + def test_should_block_post_with_origin_checking_and_wrong_origin old_logger = ActionController::Base.logger logger = ActiveSupport::LogSubscriber::TestHelper::MockLogger.new |