From 9b95fa7777c4b484f8053b87f48d65c853945f19 Mon Sep 17 00:00:00 2001 From: Bouke Haarsma Date: Sun, 3 Nov 2013 09:18:48 +0100 Subject: Fixed #21322 -- Error message when CSRF cookie is missing Thanks to Henrik Levkowetz and olau for their reports and initial patches. --- tests/view_tests/tests/test_csrf.py | 38 ++++++++++++++++++++++++++++++++++--- 1 file changed, 35 insertions(+), 3 deletions(-) (limited to 'tests') diff --git a/tests/view_tests/tests/test_csrf.py b/tests/view_tests/tests/test_csrf.py index 8e5c7f950a..2a3f51125a 100644 --- a/tests/view_tests/tests/test_csrf.py +++ b/tests/view_tests/tests/test_csrf.py @@ -5,6 +5,10 @@ from django.utils.translation import override class CsrfViewTests(TestCase): urls = "view_tests.urls" + def setUp(self): + super(CsrfViewTests, self).setUp() + self.client = Client(enforce_csrf_checks=True) + @override_settings( USE_I18N=True, MIDDLEWARE_CLASSES=( @@ -17,17 +21,45 @@ class CsrfViewTests(TestCase): """ Test that an invalid request is rejected with a localized error message. """ - self.client = Client(enforce_csrf_checks=True) - response = self.client.post('/', HTTP_HOST='www.example.com') + response = self.client.post('/') self.assertContains(response, "Forbidden", status_code=403) self.assertContains(response, "CSRF verification failed. Request aborted.", status_code=403) with self.settings(LANGUAGE_CODE='nl'), override('en-us'): - response = self.client.post('/', HTTP_HOST='www.example.com') + response = self.client.post('/') self.assertContains(response, "Verboden", status_code=403) self.assertContains(response, "CSRF-verificatie mislukt. Verzoek afgebroken.", status_code=403) + + @override_settings( + SECURE_PROXY_SSL_HEADER=('HTTP_X_FORWARDED_PROTO', 'https') + ) + def test_no_referer(self): + """ + Referer header is strictly checked for POST over HTTPS. Trigger the + exception by sending an incorrect referer. + """ + response = self.client.post('/', HTTP_X_FORWARDED_PROTO='https') + self.assertContains(response, + "You are seeing this message because this HTTPS " + "site requires a 'Referer header' to be " + "sent by your Web browser, but none was sent.", + status_code=403) + + def test_no_cookies(self): + """ + The CSRF cookie is checked for POST. Failure to send this cookie should + provide a nice error message. + """ + response = self.client.post('/') + self.assertContains(response, + "You are seeing this message because this site " + "requires a CSRF cookie when submitting forms. " + "This cookie is required for security reasons, to " + "ensure that your browser is not being hijacked " + "by third parties.", + status_code=403) -- cgit v1.3