Repository navigation
Conversation
|
Hello @boo-code! This is your first pull request on ps_apiresources repository of the PrestaShop project. Thank you, and welcome to this Open Source community! |
| * The Admin API is stateless and OAuth-authenticated, so the IRIs it returns (here the | ||
| * Location header of a POST) must not carry the admin CSRF _token. See PrestaShop/PrestaShop#39496. | ||
| */ | ||
| public function testCreateResponseLocationHeaderHasNoAdminToken(): void |
There was a problem hiding this comment.
No core carries the fix yet, and 9.0.3 / 9.1.5 in the CI matrix never will, so this test needs a version gate. Could you start it with $this->markTestSkippedByMinVersion('9.2.1'), or whichever 9.2 patch ends up shipping PrestaShop/PrestaShop#42221?
| ], | ||
| ]); | ||
| self::assertResponseStatusCodeSame(201); | ||
| $location = $response->getHeaders(false)['location'][0] ?? ''; |
There was a problem hiding this comment.
With ?? '', a response without any Location header passes too. Asserting the IRI itself, e.g. assertMatchesRegularExpression('#/attributes/groups/\d+$#', $location), would cover both cases.
1d00184 to
c1ddcc0
Compare
|
Done: the test starts with |
Locationheader carries no admin_token.Context
PrestaShop/PrestaShop#39496: Admin API IRIs leaked the admin CSRF
_token. The core fix PrestaShop/PrestaShop#41847 stops adding it to API Platform routes.This adds a regression test asserting the
POST /attributes/groupsLocationheader has no_token.Verification
Against an install with the core fix: green. Without it: red (
Location: /attributes/groups/5?_token=…).The test starts with
markTestSkippedByMinVersion('9.2.1'), the milestone of PrestaShop/PrestaShop#42221. The 9.2.x branch already reports 9.2.1, so the 9.2.x and develop legs run it and stay red until PrestaShop/PrestaShop#42221 merges.