69 lines
2.6 KiB
Python
69 lines
2.6 KiB
Python
"""Anmeldung, Sitzung, CSRF, Sicherheitsköpfe."""
|
|
|
|
from fastapi.testclient import TestClient
|
|
|
|
from helpers import PASSWORD
|
|
|
|
|
|
def test_ohne_anmeldung_zur_login_seite(app, people):
|
|
with TestClient(app) as client:
|
|
response = client.get("/workspaces", follow_redirects=False)
|
|
assert response.status_code == 303
|
|
assert response.headers["location"] == "/login?next=/workspaces"
|
|
|
|
|
|
def test_falsches_passwort(app, people):
|
|
with TestClient(app) as client:
|
|
response = client.post("/login", data={"username": "anna", "password": "falsch"})
|
|
assert response.status_code == 401
|
|
assert "falsch" in response.text
|
|
|
|
|
|
def test_unbekannter_nutzer(app, people):
|
|
with TestClient(app) as client:
|
|
response = client.post("/login", data={"username": "niemand", "password": PASSWORD})
|
|
assert response.status_code == 401
|
|
|
|
|
|
def test_demo_anmeldung_abgeschaltet_ohne_passwort(settings, db, people):
|
|
from app.main import create_app
|
|
app = create_app(settings.model_copy(update={"demo_password": ""}))
|
|
with TestClient(app) as client:
|
|
response = client.post("/login", data={"username": "anna", "password": ""})
|
|
assert response.status_code in (401, 422)
|
|
|
|
|
|
def test_anmelden_und_abmelden(browser, people):
|
|
b = browser("anna")
|
|
assert b.get("/workspaces").status_code == 200
|
|
assert b.post("/logout").status_code == 303
|
|
assert b.get("/workspaces", follow_redirects=False).status_code == 303
|
|
|
|
|
|
def test_kein_open_redirect(app, people):
|
|
with TestClient(app) as client:
|
|
response = client.post("/login", data={"username": "anna", "password": PASSWORD,
|
|
"next": "//boese.example"}, follow_redirects=False)
|
|
assert response.headers["location"] == "/workspaces"
|
|
|
|
|
|
def test_schreiben_ohne_csrf_abgelehnt(browser, people):
|
|
b = browser("anna")
|
|
response = b.client.post("/workspaces", data={"team_id": people["team_demo"], "name": "X"},
|
|
follow_redirects=False)
|
|
assert response.status_code == 403
|
|
|
|
|
|
def test_csrf_per_kopfzeile(browser, people):
|
|
b = browser("anna")
|
|
response = b.client.post("/workspaces", data={"team_id": people["team_demo"], "name": "X"},
|
|
headers={"X-CSRF-Token": b.csrf}, follow_redirects=False)
|
|
assert response.status_code == 303
|
|
|
|
|
|
def test_sicherheitskoepfe(browser, people):
|
|
response = browser("anna").get("/workspaces")
|
|
assert "script-src 'self'" in response.headers["Content-Security-Policy"]
|
|
assert "unsafe-inline" not in response.headers["Content-Security-Policy"]
|
|
assert response.headers["X-Frame-Options"] == "DENY"
|
|
assert response.headers["Cache-Control"] == "no-store"
|