How to include a CSRF Token in get route in Laravel tests?

Question

To prevent CSRF attacks, I'm adding a state parameter with my current CSRF token to an external link. When the external page redirects the user back to my site, it will include the state.

With a simple condition I can check it in my controller:

if($data['state'] !== csrf_token()){
    throw new TokenMismatchException;
}

Now I want to write a test for it to pass the if condition, but csrf_token() is empty in the test directory, however not in the controller. So it fails, unfortunately. Here is an excerpt of the test:

/** @test */
public function it_saves_the_data_in_database() 
{
  $this->get(route('connect.index', [
    'scope' => $this->scope,
    'code' => $this->code,
    'state' => csrf_token(), //it's null here...
  ]))->assertStatus(200); //however it returns 419
}

Is it possible to generate the token before?

My current solution is ugly: if($data['state'] !== csrf_token() && (env('APP_ENV') === "testing" && $data['state'] !== 'testing')) — Philipp Mochine, Aug 22 '18 at 12:33
Why do you need to check the token in your controller? Use the included middleware.. — Devon Bessemer, Aug 22 '18 at 12:36
@Devon, as I understand, it won't work. The redirect URI is a get route and the parameter is set to "state" with the token. — Philipp Mochine, Aug 22 '18 at 12:38
Ok, I see, but not sure why'd you need a csrf token for a get request. sounds like an XY problem then. — Devon Bessemer, Aug 22 '18 at 12:42
@Devon sorry needed to be afk, but I need this for Stripe Connect. See here: https://stripe.com/docs/connect/standard-accounts — Philipp Mochine, Aug 22 '18 at 12:55

score 1 · Answer 1 · answered Jun 10 '22 at 06:20

If you wrote HTTP access testing code before you use crsf_token() like below example.

The csrf token seems to be generated in that test session.

$this->get(...)

$this->get(route('connect.index', [
    'scope' => $this->scope,
    'code' => $this->code,
    'state' => csrf_token(), //it's null here...
  ]))->assertStatus(200);

How to include a CSRF Token in get route in Laravel tests?

1 Answers1