diff options
| author | Luke Plant <L.Plant.98@cantab.net> | 2011-05-09 23:00:22 +0000 |
|---|---|---|
| committer | Luke Plant <L.Plant.98@cantab.net> | 2011-05-09 23:00:22 +0000 |
| commit | 8cbcf1d3a60a0ba1a6f3ddde9317ac07b67c6c5d (patch) | |
| tree | 3c3167a0ee242211f6b2637e62c99ff34a896d15 /tests | |
| parent | a75120927e52210c062cd54d1cf2a6968b507cf5 (diff) | |
Fixed #14134 - ability to set cookie 'path' and 'secure' attributes of CSRF cookie
Thanks to cfattarsi for the report and initial patch.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@16200 bcc190cf-cafb-0310-a4f2-bffc1f526a37
Diffstat (limited to 'tests')
| -rw-r--r-- | tests/regressiontests/csrf_tests/tests.py | 18 |
1 files changed, 13 insertions, 5 deletions
diff --git a/tests/regressiontests/csrf_tests/tests.py b/tests/regressiontests/csrf_tests/tests.py index 1285c1ddac..8dc3fbbc1b 100644 --- a/tests/regressiontests/csrf_tests/tests.py +++ b/tests/regressiontests/csrf_tests/tests.py @@ -82,13 +82,21 @@ class CsrfViewMiddlewareTest(TestCase): patched. """ req = self._get_GET_no_csrf_cookie_request() - # token_view calls get_token() indirectly - CsrfViewMiddleware().process_view(req, token_view, (), {}) - resp = token_view(req) - resp2 = CsrfViewMiddleware().process_response(req, resp) - csrf_cookie = resp2.cookies.get(settings.CSRF_COOKIE_NAME, False) + # Put tests for CSRF_COOKIE_* settings here + with self.settings(CSRF_COOKIE_NAME='myname', + CSRF_COOKIE_DOMAIN='.example.com', + CSRF_COOKIE_PATH='/test/', + CSRF_COOKIE_SECURE=True): + # token_view calls get_token() indirectly + CsrfViewMiddleware().process_view(req, token_view, (), {}) + resp = token_view(req) + resp2 = CsrfViewMiddleware().process_response(req, resp) + csrf_cookie = resp2.cookies.get('myname', False) self.assertNotEqual(csrf_cookie, False) + self.assertEqual(csrf_cookie['domain'], '.example.com') + self.assertEqual(csrf_cookie['secure'], True) + self.assertEqual(csrf_cookie['path'], '/test/') self.assertTrue('Cookie' in resp2.get('Vary','')) def test_process_response_get_token_not_used(self): |