Repository: rails/rails
File: actionpack/test/controller/request_forgery_protection_test.rb (Ruby)

Code before:

  test "Sec-Fetch-Site check is case insensitive" do
    @request.set_header "HTTP_SEC_FETCH_SITE", "Same-Site"
    post :index
    assert_response :success
  end

  private
    def initialize_csrf_token(token = @token, session = self.session)
      session[:_csrf_token] = token
    end

    def forgery_protection_origin_check
      old_setting = ActionController::Base.forgery_protection_origin_check
      ActionController::Base.forgery_protection_origin_check = true
      begin
        yield
      ensure
        ActionController::Base.forgery_protection_origin_check = old_setting
      end
    end
end

class InvalidVerificationStrategyTest < ActionController::TestCase
  def test_raises_argument_error_for_invalid_using_option
    assert_raises(ArgumentError) do
      Class.new(ActionController::Base) do
        protect_from_forgery using: :invalid_strategy
      end
    end
  end

  def test_raises_argument_error_for_authenticity_token_option
    assert_raises(ArgumentError) do
      Class.new(ActionController::Base) do
        protect_from_forgery using: :authenticity_token
      end
    end
  end
end


class TrustedOriginsHeaderOnlyController < ActionController::Base
  include RequestForgeryProtectionActions
  protect_from_forgery using: :header_only, with: :exception,
    trusted_origins: ["https://trusted.example.com", "https://oauth.provider.com"]
end

class TrustedOriginsHeaderOrLegacyTokenController < ActionController::Base
  include RequestForgeryProtectionActions
  protect_from_forgery using: :header_or_legacy_token, with: :exception,

Review comment (suggestion):
I've added this assert because of https://github.com/rails/rails/blob/42f327ecd10623ca492db415c3a304786aa3ea19/actionpack/lib/action_controller/metal/request_forgery_protection.rb#L122

to make it clear that the default value is `:header_or_legacy_token`

Code after:
  test "Sec-Fetch-Site check is case insensitive" do
    @request.set_header "HTTP_SEC_FETCH_SITE", "Same-Site"
    post :index
    assert_response :success
  end

  private
    def initialize_csrf_token(token = @token, session = self.session)
      session[:_csrf_token] = token
    end

    def forgery_protection_origin_check
      old_setting = ActionController::Base.forgery_protection_origin_check
      ActionController::Base.forgery_protection_origin_check = true
      begin
        yield
      ensure
        ActionController::Base.forgery_protection_origin_check = old_setting
      end
    end
end

class ConfiguredVerificationStrategyTest < ActiveSupport::TestCase
  test "protect_from_forgery respects configured verification strategy when :using is not provided" do
    old_strategy = ActionController::Base.forgery_protection_verification_strategy
    assert_equal :header_or_legacy_token, old_strategy

    ActionController::Base.forgery_protection_verification_strategy = :header_only

    controller_class = Class.new(ActionController::Base) do
      include RequestForgeryProtectionActions
      protect_from_forgery with: :exception
    end

    assert_equal :header_only, controller_class.forgery_protection_verification_strategy
  ensure
    ActionController::Base.forgery_protection_verification_strategy = old_strategy
  end
end

class InvalidVerificationStrategyTest < ActionController::TestCase
  def test_raises_argument_error_for_invalid_using_option
    assert_raises(ArgumentError) do
      Class.new(ActionController::Base) do
        protect_from_forgery using: :invalid_strategy
      end
    end
  end

  def test_raises_argument_error_for_authenticity_token_option
    assert_raises(ArgumentError) do