mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-07-19 03:05:32 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Fixed #27611 -- Doc'd that CSRF_COOKIE_HTTPONLY setting offers no security.

Browse source
This commit is contained in:
Tim Graham 2016-12-19 17:56:58 -05:00 • committed by GitHub
parent 1a04b1762b
commit c27104a9c7
4 changed files with 15 additions and 65 deletions
Download patch file Download diff file Expand all files Collapse all files

42
tests/check_framework/test_security.py
View file

@ -192,48 +192,6 @@ class CheckCSRFCookieSecureTest(SimpleTestCase):
self.assertEqual(self.func(None), [])
class CheckCSRFCookieHttpOnlyTest(SimpleTestCase):
@property
def func(self):
from django.core.checks.security.csrf import check_csrf_cookie_httponly
return check_csrf_cookie_httponly
@override_settings(
MIDDLEWARE=["django.middleware.csrf.CsrfViewMiddleware"],
CSRF_COOKIE_HTTPONLY=False)
def test_with_csrf_cookie_httponly_false(self):
"""
Warn if CsrfViewMiddleware is in MIDDLEWARE but
CSRF_COOKIE_HTTPONLY isn't True.
"""
self.assertEqual(self.func(None), [csrf.W017])
@override_settings(
MIDDLEWARE=["django.middleware.csrf.CsrfViewMiddleware"],
CSRF_USE_SESSIONS=True,
CSRF_COOKIE_HTTPONLY=False)
def test_use_sessions_with_csrf_cookie_httponly_false(self):
"""
No warning if CSRF_COOKIE_HTTPONLY isn't True while CSRF_USE_SESSIONS
is True.
"""
self.assertEqual(self.func(None), [])
@override_settings(MIDDLEWARE=[], MIDDLEWARE_CLASSES=[], CSRF_COOKIE_HTTPONLY=False)
def test_with_csrf_cookie_httponly_false_no_middleware(self):
"""
No warning if CsrfViewMiddleware isn't in MIDDLEWARE, even if
CSRF_COOKIE_HTTPONLY is False.
"""
self.assertEqual(self.func(None), [])
@override_settings(
MIDDLEWARE=["django.middleware.csrf.CsrfViewMiddleware"],
CSRF_COOKIE_HTTPONLY=True)
def test_with_csrf_cookie_httponly_true(self):
self.assertEqual(self.func(None), [])
class CheckSecurityMiddlewareTest(SimpleTestCase):
@property
def func(self):