TheIntern test framework asynchronous setup

Question

As part of my project I am using https://github.com/theintern/intern/ to run unit and functional tests.

In one of my tests I am testing the server implementation of the JSON Rest API. I need this implementation to work with the Dojo JSON Rest client ( http://dojotoolkit.org/reference-guide/1.10/dojo/store/JsonRest.html ).

Therefore I am trying to manually trigger the XHRs that Dojo Store is supposed to do. However, I do not know how to get around the CSRF protection in the browser since I could not find a way to integrate my server implementation (that I wish to test) with the web server found inside the Intern framework.

Intern webserver runs at http://localhost:9000 and my JSON Rest Store is at http://localhost:3000 , hence CSRF browser protection triggers.

Normally the page needing to do XHR across servers needs some sort of CSRF token/cookie authorization from the original server. How can I perform this with the Intern? If I need to obtain this authorization from the JSON REST API server implementation, then my server won't be work as a REST implementation because I need to track state. Am I getting this right?

In my application proper (production server) this is not a problem because the server implementation of the JSON Rest API is also serving the static HTML page that initiates the XHR.

UPDATE : I've found a guide about stateless CSRF protection: http://appsandsecurity.blogspot.de/2012/01/stateless-csrf-protection.html . Still I need to test this and see how it applies to Dojo JSON Rest stores.

Answer 1

I've heard you can disable CSRF protections in some browsers, if you need that for development. However, that protection is a very crucial thing, without it AJAX requests would be too dangerous to allow the pages to use them...

Your both web application and REST channel must be on the same IP and same port . If you have 2 separate servers, the way to achieve it is using a proxy server . Either one of the servers offer such functionality, or you use the third (like Apache) to proxy calls to both servers.

I'm using Apache HTTPD with mod_proxy . I store the client code (html and js) on apache, and I redirect the calls to rest services using config defined in httpd.conf :

ProxyPass /myapp/rest/ http://l0calhost:9000/myapp/rest/

Your rest channel will be availabe them (if your apache server listens on l0calhost:3000 ) under http://l0calhost:3000/myapp/rest , and the application (JS) can refer to it under /myapp/rest.

of course, you need first to uncomment the lines activating the mod_proxy

LoadModule proxy_module modules/mod_proxy.so
LoadModule proxy_http_module modules/mod_proxy_http.so