entrouvert
/
hobo
16
0
Fork 0
Code Issues Pull Requests 15 Releases Activity

middleware: define setting for CSRF cookie SameSite value (#48767)

This commit is contained in:
Benjamin Dauvergne 2020-11-23 19:04:09 +01:00
parent 44ed90ad84
commit 17ee1bf6d5
3 changed files with 14 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
hobo/middleware/cookies_samesite.py
View File

@ -27,7 +27,9 @@ class CookiesSameSiteFixMiddleware(MiddlewareMixin):
# this can be removed once django 2.2 is used and settings.
# CSRF_COOKIE_SAMESITE & SESSION_COOKIE_SAMESITE can be used.
if settings.CSRF_COOKIE_NAME in response.cookies:
response.cookies[settings.CSRF_COOKIE_NAME]['samesite'] = 'None'
response.cookies[settings.CSRF_COOKIE_NAME]['samesite'] = (
getattr(settings, 'CSRF_COOKIE_SAMESITE', 'None').title()
)
if settings.SESSION_COOKIE_NAME in response.cookies:
response.cookies[settings.SESSION_COOKIE_NAME]['samesite'] = 'None'
return response

2
hobo/test_urls.py
View File

@ -8,6 +8,8 @@ def helloworld(request):
logging.getLogger(__name__).error('wat!')
if 'raise' in request.GET:
raise Exception('wat!')
request.META['CSRF_COOKIE_USED'] = True
request.META['CSRF_COOKIE'] = 'xxx'
return HttpResponse('Hello world %s' % request.META['REMOTE_ADDR'])
urlpatterns = [

9
tests_multitenant/test_middleware.py
View File

@ -30,3 +30,12 @@ def test_internalipmiddleware(app, tenants, settings):
response = app.get('/?raise', status=500, extra_environ={'HTTP_HOST': tenants[0].domain_url})
assert 'You\'re seeing this error because you have' in response.text
def test_samesite_middleware(app, tenants, settings):
settings.ALLOWED_HOSTS = [tenants[0].domain_url]
response = app.get('/', extra_environ={'HTTP_HOST': tenants[0].domain_url})
assert 'SameSite=None' in str(response)
app.cookiejar.clear()
settings.CSRF_COOKIE_SAMESITE = 'lax'
response = app.get('/', extra_environ={'HTTP_HOST': tenants[0].domain_url})
assert 'SameSite=Lax' in str(response)