mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-08-30 23:37:50 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Refs #16010 -- Required CSRF_TRUSTED_ORIGINS setting to include the scheme.

Browse source
This commit is contained in:
Tim Graham 2021-01-12 19:55:02 -05:00 • committed by Mariusz Felisiak
parent 9bf5e9418f
commit dba44a7a7a
8 changed files with 89 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

4
tests/csrf_tests/tests.py
View file

@ -399,7 +399,7 @@ class CsrfViewMiddlewareTestMixin:
resp = mw.process_view(req, post_form_view, (), {})
self.assertIsNone(resp)
@override_settings(ALLOWED_HOSTS=['www.example.com'], CSRF_TRUSTED_ORIGINS=['dashboard.example.com'])
@override_settings(ALLOWED_HOSTS=['www.example.com'], CSRF_TRUSTED_ORIGINS=['https://dashboard.example.com'])
def test_https_csrf_trusted_origin_allowed(self):
"""
A POST HTTPS request with a referer added to the CSRF_TRUSTED_ORIGINS
@ -414,7 +414,7 @@ class CsrfViewMiddlewareTestMixin:
resp = mw.process_view(req, post_form_view, (), {})
self.assertIsNone(resp)
@override_settings(ALLOWED_HOSTS=['www.example.com'], CSRF_TRUSTED_ORIGINS=['.example.com'])
@override_settings(ALLOWED_HOSTS=['www.example.com'], CSRF_TRUSTED_ORIGINS=['https://*.example.com'])
def test_https_csrf_wildcard_trusted_origin_allowed(self):
"""
A POST HTTPS request with a referer that matches a CSRF_TRUSTED_ORIGINS