summaryrefslogtreecommitdiff
path: root/tests/csrf_tests
AgeCommit message (Collapse)Author
2023-02-01[4.2.x] Refs #33476 -- Applied Black's 2023 stable style.David Smith
Black 23.1.0 is released which, as the first release of the year, introduces the 2023 stable style. This incorporates most of last year's preview style. https://github.com/psf/black/releases/tag/23.1.0 Backport of 097e3a70c1481ee7b042b2edd91b2be86fb7b5b6 from main
2022-03-09Fixed #33567 -- Avoided setting default text/html content type on responses.Claude Paroz
2022-02-07Refs #33476 -- Refactored code to strictly match 88 characters line length.Mariusz Felisiak
2022-02-07Refs #33476 -- Reformatted code with Black.django-bot
2021-11-29Refs #32800 -- Renamed _sanitize_token() to _check_token_format().Chris Jerdonek
2021-11-29Fixed #32800 -- Changed CsrfViewMiddleware not to mask the CSRF secret.Chris Jerdonek
This also adds CSRF_COOKIE_MASKED transitional setting helpful in migrating multiple instance of the same project to Django 4.1+. Thanks Florian Apolloner and Shai Berger for reviews. Co-Authored-By: Mariusz Felisiak <felisiak.mariusz@gmail.com>
2021-11-16Refs #32800 -- Avoided use of _does_token_match() in some CSRF tests.Chris Jerdonek
2021-11-16Refs #32800 -- Added CSRF tests for masked and unmasked secrets during GET.Chris Jerdonek
2021-08-17Refs #32800 -- Added test_masked_secret_accepted_and_not_replaced().Chris Jerdonek
This improves test_bare_secret_accepted_and_replaced() by adding a stronger assertion. It also adds a parallel test for the non-bare (masked) case.
2021-08-17Refs #32800 -- Improved CsrfViewMiddlewareTestMixin._check_token_present().Chris Jerdonek
This changes CsrfViewMiddlewareTestMixin._check_token_present() to give more detailed information if the check fails, and in particular why it failed. It also moves CsrfFunctionTests.assertMaskedSecretCorrect() to a separate CsrfFunctionTestMixin so the helper can be used in CsrfViewMiddlewareTestMixin.
2021-08-17Refs #32800 -- Used the cookie argument to ↵Chris Jerdonek
CsrfViewMiddlewareTestMixin._get_request() in more tests.
2021-08-03Refs #32800 -- Added tests of more CSRF functions.Chris Jerdonek
2021-08-03Refs #32800 -- Renamed _compare_masked_tokens() to _does_token_match().Chris Jerdonek
2021-07-23Fixed #32329 -- Made CsrfViewMiddleware catch more specific UnreadablePostError.Virtosu Bogdan
Thanks Chris Jerdonek for the review.
2021-07-23Refs #32329 -- Allowed specifying request class in csrf_tests test hooks.Virtosu Bogdan
2021-07-23Refs #32902 -- Moved ensure_csrf_cookie_view after protected_view.Chris Jerdonek
2021-07-23Fixed #32902 -- Fixed CsrfViewMiddleware.process_response()'s cookie reset ↵Chris Jerdonek
logic. Thanks Florian Apolloner and Shai Berger for reviews.
2021-07-23Refs #32902 -- Added CSRF test when rotate_token() is called between ↵Chris Jerdonek
resetting the token and processing response.
2021-06-30Refs #32885 -- Used _read_csrf_cookie()/_set_csrf_cookie() in more CSRF tests.Chris Jerdonek
2021-06-30Fixed #32885 -- Removed cookie-based token specific logic from ↵Chris Jerdonek
CsrfViewMiddlewareTestMixin.
2021-06-29Refs #32843 -- Added CsrfViewMiddlewareTestMixin._get_csrf_cookie_request() ↵Chris Jerdonek
hook.
2021-06-29Refs #32843 -- Added method/cookie arguments to ↵Chris Jerdonek
CsrfViewMiddlewareTestMixin._get_request(). This also removes unnecessary test hooks.
2021-06-29Refs #32843 -- Moved _get_GET_csrf_cookie_request() to ↵Chris Jerdonek
CsrfViewMiddlewareTestMixin.
2021-06-29Fixed #32843 -- Ensured the CSRF tests' _get_GET_csrf_cookie_request() sets ↵Chris Jerdonek
the request method.
2021-06-28Refs #32800 -- Added CsrfViewMiddleware tests for all combinations of ↵Chris Jerdonek
masked/unmasked cookies and tokens.
2021-06-28Refs #32800 -- Made CsrfViewMiddlewareTestMixin._csrf_id_cookie and ↵Chris Jerdonek
_csrf_id_token different. This also renames CsrfViewMiddlewareTestMixin._csrf_id to _csrf_id_token.
2021-06-28Refs #32800 -- Eliminated the need for separate _get_POST_bare_secret() methods.Chris Jerdonek
2021-06-28Refs #32800 -- Added to csrf_tests/tests.py the unmasked version of the secret.Chris Jerdonek
This also adds tests that the secret is correct, and updates existing tests to use the value.
2021-06-23Fixed #32817 -- Added the token source to CsrfViewMiddleware's bad token ↵Chris Jerdonek
error messages.
2021-06-23Refs #32817 -- Added tests for bad CSRF token provided via X-CSRFToken or ↵Chris Jerdonek
custom header.
2021-06-23Refs #32817 -- Added post_token/meta_token/token_header arguments to ↵Chris Jerdonek
_get_POST_csrf_cookie_request().
2021-06-23Refs #32817 -- Combined the bad-or-missing CSRF token tests.Chris Jerdonek
2021-06-01Fixed #32796 -- Changed CsrfViewMiddleware to fail earlier on badly ↵Chris Jerdonek
formatted cookie tokens.
2021-06-01Refs #32796 -- Added CsrfViewMiddleware tests for incorrectly formatted ↵Chris Jerdonek
cookie tokens.
2021-05-31Fixed #32795 -- Changed CsrfViewMiddleware to fail earlier on badly ↵Chris Jerdonek
formatted tokens.
2021-05-31Refs #32795 -- Added CsrfViewMiddleware tests for rejecting invalid or ↵Chris Jerdonek
missing tokens. This also improves test names for test_process_request_no_csrf_cookie and test_process_request_csrf_cookie_no_token. The logic being tested is actually in process_view() rather than process_request(), and it's not necessary to include the method name.
2021-05-28Fixed #32596 -- Added CsrfViewMiddleware._check_referer().Chris Jerdonek
This encapsulates CsrfViewMiddleware's referer logic into a method and updates existing tests to check the "seam" introduced by the refactor, when doing so would improve the test.
2021-05-27Refs #32596 -- Added extra tests for CsrfViewMiddleware's referer logic.Chris Jerdonek
2021-03-25Fixed #32578 -- Fixed crash in CsrfViewMiddleware when a request with Origin ↵Chris Jerdonek
header has an invalid host.
2021-03-22Made CsrfViewMiddlewareTestMixin._get_GET_no_csrf_cookie_request() return ↵Mariusz Felisiak
GET requests.
2021-03-19Fixed #32571 -- Made CsrfViewMiddleware handle invalid URLs in Referer header.Adam Donaghy
2021-03-18Fixed #16010 -- Added Origin header checking to CSRF middleware.Tim Graham
Thanks David Benjamin for the original patch, and Florian Apolloner, Chris Jerdonek, and Adam Johnson for reviews.
2021-03-18Refs #16010 -- Required CSRF_TRUSTED_ORIGINS setting to include the scheme.Tim Graham
2021-03-02Refs #21429 -- Added SimpleTestCase.assertNoLogs() on Python < 3.10.François Freitag
2020-05-11Refs #30116 -- Simplified regex match group access with Match.__getitem__().Jon Dufresne
The method has been available since Python 3.6. The shorter syntax is also marginally faster.
2020-02-25Fixed #31291 -- Renamed salt to mask for CSRF tokens.Ram Rachum
2020-02-18Refs #26601 -- Deprecated passing None as get_response arg to middleware ↵Claude Paroz
classes. This is the new contract since middleware refactoring in Django 1.10. Co-authored-by: Carlton Gibson <carlton.gibson@noumenal.es> Co-authored-by: Mariusz Felisiak <felisiak.mariusz@gmail.com>
2019-09-21Dropped obsolete mimetype kwarg in csrf test viewClaude Paroz
2019-01-28Fixed #30137 -- Replaced OSError aliases with the canonical OSError.Jon Dufresne
Used more specific errors (e.g. FileExistsError) as appropriate.
2018-09-08Fixed #29728 -- Prevented session resaving if CSRF cookie is unchanged.Michal Čihař
generated by cgit v1.3 (git 2.53.0) at 2026-10-17 19:26:55 +0000