spec: add canary for forgery protection shared context - #2842
Merged
Conversation
All no-CSRF regression specs depend on the shared context's before hook enabling ActionController::Base.allow_forgery_protection. If that hook stops applying, tokenless requests succeed trivially (test environment defaults the flag to false) and every regression spec still passes, so the suite would no longer guard the production skip_forgery_protection lines. One canary example pins the toggle.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
All no-CSRF regression specs depend on one shared-context hook with nothing pinning it works: if the hook stops applying, tokenless requests succeed trivially and the whole regression net passes vacuously. This PR adds a canary example that fails loudly when the toggle breaks.
Key changes:
spec/shared_contexts/forgery_protection_spec.rb— includes thewith forgery protection enforcedshared context (introduced in PR Skip CSRF protection for token-keyed invitation RSVP actions #2838) and assertsActionController::Base.allow_forgery_protectionis true inside an example.Why this matters
The shared context's
beforehook is the only thing enabling forgery protection for the no-CSRF regression specs across four controller spec files. The test environment defaultsallow_forgery_protectionto false, so if the hook is removed or no-ops, tokenless requests succeed anyway, every regression spec still passes, and the suite silently stops guarding the productionskip_forgery_protectionlines. Nothing in the suite would detect that: disabling the hook leaves all 41 examples green.