romshark / datapages / 36236164042

53%

Build Type

push

github

Committed by romshark

Commit Message

fix: Write CSRF scripts from session cookies

A handler without a session parameter doesn't read the session store.
Its document still needs the cookie's token because `CheckCSRFOnly`
validates actions against that cookie.
Without the script, those actions return 403.

Documents derive the script from the cookie without a store read.
Responses with `newSession` or `closeSession` use the resulting token.
`PageOffline` and page-cache entries
omit it because visitors share them.

Coverage Stats

25 of 61 new or added lines in 7 files covered. (40.98%)

31 existing lines in 2 files now uncovered.

14371 of 35817 relevant lines covered (40.12%)

549.13 hits per line