67 lines
2.2 KiB
Python
67 lines
2.2 KiB
Python
from app import create_app
|
|
|
|
|
|
def test_dynamic_responses_have_security_headers(client):
|
|
response = client.get("/")
|
|
|
|
assert response.headers["Cache-Control"] == "no-store"
|
|
assert response.headers["X-Content-Type-Options"] == "nosniff"
|
|
assert response.headers["X-Frame-Options"] == "DENY"
|
|
assert response.headers["Referrer-Policy"] == "strict-origin-when-cross-origin"
|
|
policy = response.headers["Content-Security-Policy"]
|
|
assert "default-src 'self'" in policy
|
|
assert "frame-ancestors 'none'" in policy
|
|
assert "'unsafe-inline'" not in policy
|
|
|
|
|
|
def test_static_assets_have_bounded_public_cache(client):
|
|
response = client.get("/static/css/style.css")
|
|
|
|
assert response.status_code == 200
|
|
assert response.headers["Cache-Control"] == "public, max-age=3600"
|
|
|
|
|
|
def test_production_hsts_is_https_only():
|
|
app = create_app(
|
|
"production",
|
|
{
|
|
"SECRET_KEY": "production-test-only",
|
|
"SQLALCHEMY_DATABASE_URI": "sqlite:///:memory:",
|
|
},
|
|
)
|
|
client = app.test_client()
|
|
|
|
secure = client.get("/", base_url="https://steady.example")
|
|
insecure = client.get("/", base_url="http://steady.example")
|
|
|
|
assert "Strict-Transport-Security" in secure.headers
|
|
assert "Strict-Transport-Security" not in insecure.headers
|
|
|
|
|
|
def test_trusted_hosts_reject_unknown_host():
|
|
app = create_app(
|
|
"testing",
|
|
{"TRUSTED_HOSTS": ["steady.example"]},
|
|
)
|
|
client = app.test_client()
|
|
|
|
assert client.get("/", base_url="http://steady.example").status_code == 200
|
|
assert client.get("/", base_url="http://attacker.example").status_code == 400
|
|
|
|
|
|
def test_friendly_not_found_and_upload_limit(client, app):
|
|
missing = client.get("/missing-page")
|
|
assert missing.status_code == 404
|
|
assert b"That page is not here" in missing.data
|
|
|
|
original_limit = app.config["MAX_CONTENT_LENGTH"]
|
|
app.config["MAX_CONTENT_LENGTH"] = 32
|
|
try:
|
|
too_large = client.post(
|
|
"/auth/register",
|
|
data={"username": "x" * 100},
|
|
)
|
|
finally:
|
|
app.config["MAX_CONTENT_LENGTH"] = original_limit
|
|
assert too_large.status_code == 413
|
|
assert b"That file is too large" in too_large.data
|