Impossible to test CSRF protection in automated tests

[heathd]

Impossible to test CSRF protection in automated tests

[alext]

I agree that the current mock strategies are sub-optimal. For test mode, we could look at moving to use the omniauth test helpers - I took this approach in errbit (I couldn't use gds-sso becuase it doesn't play nicely with devise, so I had to just use omniauth-gds directly).

[alext]

In dev mode, maybe we should move towards not mocking out auth at all, and just make apps auth against signon properly.

[heathd]

Thanks Alex, have you got a pointer to how you used the omniauth test helpers on errbit?

[benilovj]

In dev mode, maybe we should move towards not mocking out auth at all, and just make apps auth against signon properly.

My concern is that this change will require more faffing to get from a blank slate to passing tests a working setup. Also, since almost all user models are DB-backed, won't this make tests slower?

[bradwright]

Unless I'm missing something, dev mode != test mode.

[benilovj]

@bradleywright oops sorry, my brain did a thing there, you're right (fixed my comment). But at least the faffing part is still a valid question IMHO.

[alext]

@heathd The acceptance spec for gds-sso auth is https://github.com/alphagov/errbit/blob/master/spec/acceptance/auth_with_gds_sso_spec.rb. It uses test helpers defined in https://github.com/alphagov/errbit/blob/master/spec/acceptance/acceptance_helper.rb and https://github.com/alphagov/errbit/blob/master/spec/support/gds_auth_stubs.rb

[heathd]

Alex thanks for the pointers I'll take a look