Testing a form that has csrf protection

[Wail75]

Hello,
How can I test a form that has CSRF protection?
So I have added csrf protection as mentioned in the tutorial https://docs.mojolicious.org/Mojolicious/Guides/Rendering#Cross-site-request-forgery and now my tests with Test::Mojo fail because of
$v->csrf_protect->has_error('csrf_token')
I have tried to generate a CSRF token in the test file, the csrf_token param is there but the validation still fails.
$t->post_ok($page => form => {csrf_token => $t->app->csrf_token}
Maybe I missed something somewhere else but at least, is it how I should generate the CSRF token in my test?

[kraih]

The CSRF token is stored in your active session, $t->app->csrf_token has no session.

[s1037989]

How can I test a form that has CSRF protection?

From the Mojolicious test suite, t/mojolicious/validation_lite_app.t:

use Mojo::Base -strict;

BEGIN { $ENV{MOJO_REACTOR} = 'Mojo::Reactor::Poll' }

use Test::Mojo;
use Test::More;
use Mojolicious::Lite;

any '/forgery' => sub {
  my $c = shift;
  my $v = $c->validation;
  return $c->render unless $v->has_data;
  $v->csrf_protect->required('foo');
};

my $t = Test::Mojo->new;

subtest 'Correct CSRF token' => sub {
  # See also: https://docs.mojolicious.org/Mojolicious/Guides/Testing#Cookies-and-session-management
  my $token = $t->ua->get('/forgery')->res->dom->at('[name=csrf_token]')->val;
  $t->post_ok('/forgery' => form => {csrf_token => $token, foo => 'bar'})
    ->status_is(200)
    ->content_unlike(qr/Wrong or missing CSRF token!/)
    ->element_exists('[value=bar]')
    ->element_exists_not('.field-with-error')
    ->element_count_is('[name=csrf_token]', 2)
    ->element_count_is('form',              2)
    ->element_exists('form > input[name=csrf_token] + input[type=submit]');
  isnt $t->tx->res->dom->find('[name=csrf_token]')->[0]->val, $t->tx->res->dom->find('[name=csrf_token]')->[1]->val,
    'different masked tokens';
};

done_testing;

__DATA__

@@ forgery.html.ep
%= form_for forgery => begin
  %= 'Wrong or missing CSRF token!' if validation->has_error('csrf_token')
  %= csrf_field
  %= text_field 'foo'
%= end
%= csrf_button_to Root => '/'

$ prove /tmp/csrf.pl
/tmp/csrf.pl .. ok
All tests successful.
Files=1, Tests=1,  0 wallclock secs ( 0.01 usr  0.00 sys +  0.10 cusr  0.01 csys =  0.12 CPU)
Result: PASS

[Wail75]

Thank you, I did not think of finding the token in a page...