tower-surf 0.3.0

🌊 A stateless CSRF middleware for tower.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130

use std::str::FromStr;

use anyhow::Result;
use axum::{
    routing::{get, post},
    Router,
};
use axum_test::{TestServer, TestServerConfig};
use http::{HeaderName, HeaderValue, StatusCode};
use tower_surf::{Surf, Token};

#[tokio::test]
async fn creates_initial_cookie() -> Result<()> {
    let app = Router::new()
        .route("/", get(|| async {}))
        .layer(Surf::new("secret-key"));

    let config = TestServerConfig::builder().save_cookies().build();
    let server = TestServer::new_with_config(app, config)?;

    let cookies = server.get("/").await.cookies();
    let cookie = cookies.get("__HOST-csrf_token");
    assert!(cookie.is_some());

    Ok(())
}

#[tokio::test]
async fn updates_cookie() -> Result<()> {
    async fn set_token(token: Token) -> Result<StatusCode, StatusCode> {
        token
            .set("unique-session-id")
            .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;

        Ok(StatusCode::OK)
    }

    let app = Router::new()
        .route("/", get(|| async {}))
        .route("/a", get(set_token))
        .layer(Surf::new("secret-key"));

    let config = TestServerConfig::builder().save_cookies().build();
    let server = TestServer::new_with_config(app, config)?;

    server.get("/").await;

    let cookies = server.get("/a").await.cookies();
    let cookie = cookies.get("__HOST-csrf_token").expect("cookie not found.");
    assert!(cookie.value().contains("unique-session-id"));

    Ok(())
}

#[tokio::test]
async fn resets_cookie() -> Result<()> {
    async fn set_token(token: Token) -> Result<StatusCode, StatusCode> {
        token
            .set("unique-session-id")
            .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;

        Ok(StatusCode::OK)
    }

    async fn reset_token(token: Token) -> Result<StatusCode, StatusCode> {
        token.reset();

        Ok(StatusCode::OK)
    }

    let app = Router::new()
        .route("/", get(|| async {}))
        .route("/a", get(set_token))
        .route("/b", get(reset_token))
        .layer(Surf::new("secret-key"));

    let config = TestServerConfig::builder().save_cookies().build();
    let server = TestServer::new_with_config(app, config)?;

    server.get("/").await;
    server.get("/a").await;

    let cookies = server.get("/b").await.cookies();
    let cookie = cookies.get("__HOST-csrf_token").expect("cookie not found.");
    assert!(!cookie.value().contains("unique-session-id"));

    Ok(())
}

#[tokio::test]
async fn guards_mutation() -> Result<()> {
    let app = Router::new()
        .route("/", get(|| async {}))
        .route("/", post(|| async {}))
        .layer(Surf::new("secret-key"));

    let config = TestServerConfig::builder().save_cookies().build();
    let mut server = TestServer::new_with_config(app, config)?;

    let cookies = server.get("/").await.cookies();
    let cookie = cookies.get("__HOST-csrf_token").expect("cookie not found.");

    // Correct token sent.

    server.add_header(
        HeaderName::from_str("X-CSRF-Token").expect("couldn't create HeaderName"),
        HeaderValue::from_str(cookie.value()).expect("couldn't create HeaderValue"),
    );

    server.post("/").await.assert_status_ok();

    // Incorrect token sent.

    server.clear_headers();

    server.add_header(
        HeaderName::from_str("X-CSRF-Token").expect("couldn't create HeaderName"),
        HeaderValue::from_str("oh howdy doody").expect("couldn't create HeaderValue"),
    );

    server.post("/").await.assert_status_forbidden();

    // No token sent.

    server.clear_headers();

    server.post("/").await.assert_status_forbidden();

    Ok(())
}