作者：AdrianFree覀 | 来源：互联网 | 2023-09-13 14:43
Fixes #1941, #1905
Part of #1891
Supercedes #2009
Changes proposed in this pull request:
- Add CSRF extender with exemptPath method
- Exempt '/api/token' from CSRF checks
- Add integration tests for CSRF extender
- Remove 'csrf token exempt' from token endpoint integration tests
Confirmed
- [x] Frontend changes: tested on a local Flarum installation.
- [x] Backend changes: tests are green (run
).
该提问来源于开源项目：flarum/core
Done! It's actually pretty trivial since CSRF evaluates before the route dispatcher so route doesnt actually need to exist! I still want to keep the other test case with a real route though since that shows that it can get all the way to the route.
Haha, I just learned that when looking at the new tests, too. Thanks, that's a good solution!
京公网安备 11010802041100号