ezsystems /
ezpublish-kernel
| @@ 62-71 (lines=10) @@ | ||
| 59 | self::assertHttpResponseDeletesSessionCookie($session, $response); |
|
| 60 | } |
|
| 61 | ||
| 62 | public function testRefreshSessionMissingCsrfToken() |
|
| 63 | { |
|
| 64 | $session = $this->login(); |
|
| 65 | ||
| 66 | $refreshRequest = $this |
|
| 67 | ->createRefreshRequest($session) |
|
| 68 | ->withoutHeader('X-CSRF-Token'); |
|
| 69 | $response = $this->sendHttpRequest($refreshRequest); |
|
| 70 | self::assertHttpResponseCodeEquals($response, 401); |
|
| 71 | } |
|
| 72 | ||
| 73 | public function testDeleteSession() |
|
| 74 | { |
|
| @@ 86-94 (lines=9) @@ | ||
| 83 | /** |
|
| 84 | * CSRF needs to be tested as session handling bypasses the CsrfListener. |
|
| 85 | */ |
|
| 86 | public function testDeleteSessionMissingCsrfToken() |
|
| 87 | { |
|
| 88 | $session = $this->login(); |
|
| 89 | $request = $this |
|
| 90 | ->createDeleteRequest($session) |
|
| 91 | ->withoutHeader('X-CSRF-Token'); |
|
| 92 | $response = $this->sendHttpRequest($request); |
|
| 93 | self::assertHttpResponseCodeEquals($response, 401); |
|
| 94 | } |
|
| 95 | ||
| 96 | public function testLoginWithExistingFrontendSession() |
|
| 97 | { |
|
