CSRF-Protector-PHP
CSRF-Protector-PHP copied to clipboard
`checkHeader()` method fault after multiple test method runs
csrfp_wrapper::checkHeader() returns on first match of a header name but I've noticed an issue with it after modeling a getHeaderValue() method on it. The array returned by xdebug_get_headers() accumulates values throughout the entire test process. In the first test method to run, a call to checkHeader() is reliable because the array returned by xdebug_get_headers() contains only values set from headers sent during that test method.
But additional test methods that result in header()/setcookie() calls continue appending values onto the header array without emptying it out first. Subsequent calls to checkHeader() with the same argument do not guarantee that the header string matched is from the recent test method and will always return a positive result if any previous test had a positive result.
To verify this behavior, you can add something like print_r(xdebug_get_headers()) after one of the later calls to checkHeader(). Its contents will be not one, but several Set-Cookie headers while the checkHeader('Set-Cookie') call returns true by matching only the first.