diff options
Diffstat (limited to 'tests/middleware')
| -rw-r--r-- | tests/middleware/test_security.py | 39 |
1 files changed, 39 insertions, 0 deletions
diff --git a/tests/middleware/test_security.py b/tests/middleware/test_security.py index d766643b9b..1b7434c9a8 100644 --- a/tests/middleware/test_security.py +++ b/tests/middleware/test_security.py @@ -282,3 +282,42 @@ class SecurityMiddlewareTest(SimpleTestCase): """ response = self.process_response(headers={'Referrer-Policy': 'unsafe-url'}) self.assertEqual(response.headers['Referrer-Policy'], 'unsafe-url') + + @override_settings(SECURE_CROSS_ORIGIN_OPENER_POLICY=None) + def test_coop_off(self): + """ + With SECURE_CROSS_ORIGIN_OPENER_POLICY set to None, the middleware does + not add a "Cross-Origin-Opener-Policy" header to the response. + """ + self.assertNotIn('Cross-Origin-Opener-Policy', self.process_response()) + + def test_coop_default(self): + """SECURE_CROSS_ORIGIN_OPENER_POLICY defaults to same-origin.""" + self.assertEqual( + self.process_response().headers['Cross-Origin-Opener-Policy'], + 'same-origin', + ) + + def test_coop_on(self): + """ + With SECURE_CROSS_ORIGIN_OPENER_POLICY set to a valid value, the + middleware adds a "Cross-Origin_Opener-Policy" header to the response. + """ + tests = ['same-origin', 'same-origin-allow-popups', 'unsafe-none'] + for value in tests: + with self.subTest(value=value), override_settings( + SECURE_CROSS_ORIGIN_OPENER_POLICY=value, + ): + self.assertEqual( + self.process_response().headers['Cross-Origin-Opener-Policy'], + value, + ) + + @override_settings(SECURE_CROSS_ORIGIN_OPENER_POLICY='unsafe-none') + def test_coop_already_present(self): + """ + The middleware doesn't override a "Cross-Origin-Opener-Policy" header + already present in the response. + """ + response = self.process_response(headers={'Cross-Origin-Opener-Policy': 'same-origin'}) + self.assertEqual(response.headers['Cross-Origin-Opener-Policy'], 'same-origin') |