Initial curated itworx-knowledge-hub source from 3b1751d0d9dee551aa6994eee0093704dc334817

tests/backend/ItWorx.KnowledgeHub.IntegrationTests/Auth/CsrfTests.cs

@@ -0,0 +1,50 @@
+using System.Net;
+using System.Net.Http.Json;
+using ItWorx.KnowledgeHub.IntegrationTests.Infrastructure;
+
+namespace ItWorx.KnowledgeHub.IntegrationTests.Auth;
+
+[Collection(PostgresTestGroup.Name)]
+public sealed class CsrfTests(PostgresContainerFixture postgres) : OwnerSetupTestBase(postgres)
+{
+    [Fact]
+    public async Task Cookie_authenticated_mutation_without_a_csrf_header_is_rejected()
+    {
+        using var client = Factory.CreateClient();
+        await SetupHelper.LoginAsync(client, OwnerEmail, OwnerPassword);
+
+        // Deliberately bypasses SetupHelper.PostWithCsrfAsync to send the mutation
+        // without ever having fetched/attached a CSRF token.
+        using var response = await client.PostAsJsonAsync("/api/v1/auth/logout", new { });
+
+        Assert.Equal(HttpStatusCode.BadRequest, response.StatusCode);
+    }
+
+    [Fact]
+    public async Task Cookie_authenticated_mutation_with_a_valid_csrf_header_succeeds()
+    {
+        using var client = Factory.CreateClient();
+        await SetupHelper.LoginAsync(client, OwnerEmail, OwnerPassword);
+
+        var response = await SetupHelper.PostWithCsrfAsync<object?>(client, "/api/v1/auth/logout", null);
+
+        Assert.Equal(HttpStatusCode.OK, response.StatusCode);
+    }
+
+    [Fact]
+    public async Task A_csrf_token_obtained_by_one_session_does_not_validate_for_another()
+    {
+        using var attackerClient = Factory.CreateClient();
+        var stolenToken = await SetupHelper.GetCsrfTokenAsync(attackerClient);
+
+        using var victimClient = Factory.CreateClient();
+        await SetupHelper.LoginAsync(victimClient, OwnerEmail, OwnerPassword);
+
+        using var request = new HttpRequestMessage(HttpMethod.Post, "/api/v1/auth/logout");
+        request.Headers.Add(stolenToken.HeaderName, stolenToken.Value);
+
+        using var response = await victimClient.SendAsync(request);
+
+        Assert.Equal(HttpStatusCode.BadRequest, response.StatusCode);
+    }
+}