How to include a CSRF Token in get route in Laravel tests?

Question

To prevent CSRF attacks, I'm adding a state parameter with my current CSRF token to an external link. When the external page redirects the user back to my site, it will include the state.

With a simple condition I can check it in my controller:

if($data['state'] !== csrf_token()){
    throw new TokenMismatchException;
}

Now I want to write a test for it to pass the if condition, but csrf_token() is empty in the test directory, however not in the controller. So it fails, unfortunately. Here is an excerpt of the test:

/** @test */
public function it_saves_the_data_in_database() 
{
  $this->get(route('connect.index', [
    'scope' => $this->scope,
    'code' => $this->code,
    'state' => csrf_token(), //it's null here...
  ]))->assertStatus(200); //however it returns 419
}

Is it possible to generate the token before?

My current solution is ugly: if($data['state'] !== csrf_token() && (env('APP_ENV') === "testing" && $data['state'] !== 'testing')) — Philipp Mochine
– Philipp Mochine, Commented Aug 22, 2018 at 12:33
Why do you need to check the token in your controller? Use the included middleware.. — Devon Bessemer
– Devon Bessemer, Commented Aug 22, 2018 at 12:36
@Devon, as I understand, it won't work. The redirect URI is a get route and the parameter is set to "state" with the token. — Philipp Mochine
– Philipp Mochine, Commented Aug 22, 2018 at 12:38
Ok, I see, but not sure why'd you need a csrf token for a get request. sounds like an XY problem then. — Devon Bessemer
– Devon Bessemer, Commented Aug 22, 2018 at 12:42
@Devon sorry needed to be afk, but I need this for Stripe Connect. See here: stripe.com/docs/connect/standard-accounts — Philipp Mochine
– Philipp Mochine, Commented Aug 22, 2018 at 12:55

hirakei1203 · Accepted Answer · 2022-06-10 06:20:01Z

2

If you wrote HTTP access testing code before you use crsf_token() like below example.

The csrf token seems to be generated in that test session.

$this->get(...)

$this->get(route('connect.index', [
    'scope' => $this->scope,
    'code' => $this->code,
    'state' => csrf_token(), //it's null here...
  ]))->assertStatus(200);

answered Jun 10, 2022 at 6:20

hirakei1203

514 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Guljahan Ilmedova Over a year ago

hello, how did you fix this?

Collectives™ on Stack Overflow

How to include a CSRF Token in get route in Laravel tests?

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related