veer 0.1.2

Inertia.js v3 server-side protocol superset for Rust
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183

#![cfg(feature = "csrf")]

use axum::{
    body::Body,
    routing::{get, post},
    Router,
};
use http::Request;
use tower::ServiceExt;
use veer::CsrfLayer;

const SECRET: &[u8] = b"0123456789012345678901234567890123456789";

fn app() -> Router {
    Router::new()
        .route("/", get(|| async { "ok" }))
        .route("/submit", post(|| async { "done" }))
        .layer(CsrfLayer::new(SECRET.to_vec()).secure(false))
}

fn req(method: &str, uri: &str) -> Request<Body> {
    Request::builder()
        .method(method)
        .uri(uri)
        .body(Body::empty())
        .unwrap()
}

/// GET issues a JS-readable XSRF-TOKEN cookie, then return its value.
async fn token_from_get() -> String {
    let resp = app().oneshot(req("GET", "/")).await.unwrap();
    let set = resp
        .headers()
        .get(http::header::SET_COOKIE)
        .unwrap()
        .to_str()
        .unwrap()
        .to_string();
    set.split(';')
        .next()
        .unwrap()
        .split_once('=')
        .unwrap()
        .1
        .to_string()
}

#[tokio::test]
async fn get_issues_readable_xsrf_cookie() {
    let resp = app().oneshot(req("GET", "/")).await.unwrap();
    assert_eq!(resp.status(), 200);
    let set = resp
        .headers()
        .get(http::header::SET_COOKIE)
        .unwrap()
        .to_str()
        .unwrap();
    assert!(set.starts_with("XSRF-TOKEN="));
    assert!(!set.to_lowercase().contains("httponly"));
}

#[tokio::test]
async fn post_with_matching_token_passes() {
    let token = token_from_get().await;
    let r = Request::builder()
        .method("POST")
        .uri("/submit")
        .header(http::header::COOKIE, format!("XSRF-TOKEN={token}"))
        .header("x-xsrf-token", &token)
        .body(Body::empty())
        .unwrap();
    let resp = app().oneshot(r).await.unwrap();
    assert_eq!(resp.status(), 200);
}

#[tokio::test]
async fn post_without_token_is_419() {
    let resp = app().oneshot(req("POST", "/submit")).await.unwrap();
    assert_eq!(resp.status(), 419);
    // A client with no cookie must be handed one so it can retry.
    let set = resp
        .headers()
        .get(http::header::SET_COOKIE)
        .unwrap()
        .to_str()
        .unwrap();
    assert!(set.starts_with("XSRF-TOKEN="));
}

#[tokio::test]
async fn post_with_mismatched_token_is_419() {
    let token = token_from_get().await;
    let r = Request::builder()
        .method("POST")
        .uri("/submit")
        .header(http::header::COOKIE, format!("XSRF-TOKEN={token}"))
        .header("x-xsrf-token", "different.value")
        .body(Body::empty())
        .unwrap();
    let resp = app().oneshot(r).await.unwrap();
    assert_eq!(resp.status(), 419);
}

#[tokio::test]
async fn excluded_path_skips_verification() {
    let app = Router::new()
        .route("/webhooks/stripe", post(|| async { "ok" }))
        .layer(
            CsrfLayer::new(SECRET.to_vec())
                .secure(false)
                .exclude("/webhooks"),
        );
    let resp = app.oneshot(req("POST", "/webhooks/stripe")).await.unwrap();
    assert_eq!(resp.status(), 200);
}

#[tokio::test]
async fn valid_cookie_not_reissued() {
    let token = token_from_get().await;
    let r = Request::builder()
        .method("GET")
        .uri("/")
        .header(http::header::COOKIE, format!("XSRF-TOKEN={token}"))
        .body(Body::empty())
        .unwrap();
    let resp = app().oneshot(r).await.unwrap();
    assert!(resp.headers().get(http::header::SET_COOKIE).is_none());
}

#[tokio::test]
async fn valid_cookie_wrong_header_is_419_and_keeps_cookie() {
    let token = token_from_get().await;
    let r = Request::builder()
        .method("POST")
        .uri("/submit")
        .header(http::header::COOKIE, format!("XSRF-TOKEN={token}"))
        .header("x-xsrf-token", "bogus.value")
        .body(Body::empty())
        .unwrap();
    let resp = app().oneshot(r).await.unwrap();
    assert_eq!(resp.status(), 419);
    // The existing cookie is still valid, so it must not be rotated.
    assert!(resp.headers().get(http::header::SET_COOKIE).is_none());
}

#[tokio::test]
async fn put_without_token_is_419() {
    // CsrfLayer intercepts before routing, so a tokenless mutating verb is
    // rejected regardless of whether a matching route exists.
    let resp = app().oneshot(req("PUT", "/submit")).await.unwrap();
    assert_eq!(resp.status(), 419);
}

#[tokio::test]
async fn options_request_is_not_verified() {
    // Safe/non-mutating methods bypass CSRF verification entirely.
    let resp = app().oneshot(req("OPTIONS", "/submit")).await.unwrap();
    assert_ne!(resp.status(), 419);
}

#[tokio::test]
async fn exclude_root_does_not_disable_csrf() {
    // `.exclude("/")` must not silently turn protection off for everything.
    let app = Router::new()
        .route("/submit", post(|| async { "done" }))
        .layer(CsrfLayer::new(SECRET.to_vec()).secure(false).exclude("/"));
    let resp = app.oneshot(req("POST", "/submit")).await.unwrap();
    assert_eq!(resp.status(), 419);
}

#[tokio::test]
async fn exclude_without_leading_slash_still_matches() {
    // `.exclude("webhooks")` is normalized to `/webhooks`.
    let app = Router::new()
        .route("/webhooks/stripe", post(|| async { "ok" }))
        .layer(
            CsrfLayer::new(SECRET.to_vec())
                .secure(false)
                .exclude("webhooks"),
        );
    let resp = app.oneshot(req("POST", "/webhooks/stripe")).await.unwrap();
    assert_eq!(resp.status(), 200);
}