Missing CSRF token makes params invalid in test

[kukicola]

Hello
In tests, CSRF token isn't set (and it's expected behavior) but calling request.params.valid? will return false because param is blank (even if my params validation rules don't include _csrf_token field):

> request.params.valid?
=> false
> request.params.errors
=> {:_csrf_token=>["must be filled"]}

I believe it's caused by:
https://github.com/hanami/controller/blob/main/lib/hanami/action/params.rb#L116
or
https://github.com/hanami/validations/blob/main/lib/hanami/validations/form.rb#L14

To fix it, I could remove input with CSRF token in views in test env or include middleware:

class RemoveCsrfParamMiddleware
  def initialize(app)
    @app = app
  end

  def call(env)
    return @app.call(env) if env["CONTENT_TYPE"]&.start_with?("multipart")

    params = Rack::Utils.parse_query(env["rack.input"].read, "&")
    params.delete("_csrf_token")
    env["rack.input"] = StringIO.new(Rack::Utils.build_query(params))
    @app.call(env)
  end
end

I think that in test env this default param validation should be removed

[jodosha]

@kukicola Hey, thanks for reporting.

Are you using hanami-controller as a standalone library, or are you using it in a Hanami app?

[kukicola]

@jodosha in Hanami app

[jodosha]

@kukicola, can you paste here the parameters that you're receiving?
Could you let me know if you are using views? Can you share the action code?

[kukicola]

I created a sample app https://github.com/kukicola/hanami-csrf-example with two simple forms (/test1 and /test2). The only difference between them is that in test2 I have params validation (without any rules specified for csrf_token param). If you run specs, you'll see that it fails for test2 since request.params.valid? validates _csrf_token as well.

So that's a bit confusing to me that hanami validates csrf param by default.

[jodosha]

@kukicola

So that's a bit confusing to me that hanami validates csrf param by default.

It allows to let that param always be accepted.

The alternative would be that each form will need the validation param counterpart. We wanted to avoid this friction.

[jodosha]

@kukicola I had a look at this problem. It's a regression from 1.0. Hanami shouldn't validate CSRF Token in test env.