make sure multiple CSRF tokens are rejected (closes #905)

mojolicious · Feb 10, 2016 · d14e796 · d14e796
1 parent fa8311b
commit d14e796
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/t/mojolicious/validation_lite_app.t b/t/mojolicious/validation_lite_app.t
@@ -227,6 +227,10 @@ $validation = $t->app->validation->input({csrf_token => 'abc', foo => 'bar'})
 ok !$validation->has_error, 'no error';
 ok $validation->required('foo')->is_valid, 'valid';
 is_deeply $validation->output, {foo => 'bar'}, 'right result';
+$validation = $t->app->validation->input({csrf_token => ['abc', 'def']})
+  ->csrf_token('abc')->csrf_protect;
+ok $validation->has_error, 'has error';
+is_deeply $validation->error('csrf_token'), ['csrf_protect'], 'right error';
 
 # Missing method and function (AUTOLOAD)
 eval { $t->app->validation->missing };