function CookieResourceTestTrait::assertAuthenticationEdgeCases

File

core/modules/rest/tests/src/Functional/CookieResourceTestTrait.php, line 124

Class

CookieResourceTestTrait

Trait for ResourceTestBase subclasses testing $auth=cookie.

Namespace

Code

protected function assertAuthenticationEdgeCases($method, Url $url, array $request_options) {
    // X-CSRF-Token request header is unnecessary for safe and side effect-free
    // HTTP methods. No need for additional assertions.
    // @see https://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html
    if (in_array($method, [
        'HEAD',
        'GET',
        'OPTIONS',
        'TRACE',
    ])) {
        return;
    }
    unset($request_options[RequestOptions::HEADERS]['X-CSRF-Token']);
    // DX: 403 when missing X-CSRF-Token request header.
    $response = $this->request($method, $url, $request_options);
    $this->assertResourceErrorResponse(403, 'X-CSRF-Token request header is missing', $response);
    $request_options[RequestOptions::HEADERS]['X-CSRF-Token'] = 'this-is-not-the-token-you-are-looking-for';
    // DX: 403 when invalid X-CSRF-Token request header.
    $response = $this->request($method, $url, $request_options);
    $this->assertResourceErrorResponse(403, 'X-CSRF-Token request header is invalid', $response);
    $request_options[RequestOptions::HEADERS]['X-CSRF-Token'] = $this->csrfToken;
}