Merge pull request #4185 from gratipay/fix-csrf-annoyance

Fix CSRF annoyance

tests/py/test_hooks.py

@@ -5,7 +5,6 @@
 from aspen.http.request import Request
 from aspen.http.response import Response
 
-from gratipay.security import csrf
 from gratipay.security.user import SESSION
 from gratipay.testing import Harness
 
@@ -115,39 +114,3 @@ def test_caching_of_simplates(self):
  r = self.client.GET('/about/')
  assert r.headers['Cache-Control'] == 'no-cache'
  assert 'Vary' not in r.headers
-
- def test_no_csrf_cookie(self):
- r = self.client.POST('/', csrf_token=False, raise_immediately=False)
- assert r.code == 403
- assert "Bad CSRF cookie" in r.body
- assert b'csrf_token' in r.headers.cookie
-
- def test_bad_csrf_cookie(self):
- r = self.client.POST('/', csrf_token=b'bad_token', raise_immediately=False)
- assert r.code == 403
- assert "Bad CSRF cookie" in r.body
- assert r.headers.cookie[b'csrf_token'].value != 'bad_token'
-
- def test_csrf_cookie_set_for_most_requests(self):
- r = self.client.GET('/about/')
- assert b'csrf_token' in r.headers.cookie
-
- def test_no_csrf_cookie_set_for_assets(self):
- r = self.client.GET('/assets/gratipay.css')
- assert b'csrf_token' not in r.headers.cookie
-
- def test_sanitize_token_passes_through_good_token(self):
- token = 'ddddeeeeaaaaddddbbbbeeeeeeeeffff'
- assert csrf._sanitize_token(token) == token
-
- def test_sanitize_token_rejects_overlong_token(self):
- token = 'ddddeeeeaaaaddddbbbbeeeeeeeefffff'
- assert csrf._sanitize_token(token) is None
-
- def test_sanitize_token_rejects_underlong_token(self):
- token = 'ddddeeeeaaaaddddbbbbeeeeeeeefff'
- assert csrf._sanitize_token(token) is None
-
- def test_sanitize_token_rejects_goofy_token(self):
- token = 'ddddeeeeaaaadddd bbbbeeeeeeeefff'
- assert csrf._sanitize_token(token) is None

tests/py/test_security_csrf.py

@@ -0,0 +1,49 @@
+# -*- coding: utf-8 -*-
+from __future__ import absolute_import, division, print_function, unicode_literals
+
+from gratipay.security import csrf
+from gratipay.testing import Harness
+
+
+class Tests(Harness):
+
+ # st - _sanitize_token
+
+ def test_st_passes_through_good_token(self):
+ token = 'ddddeeeeaaaaddddbbbbeeeeeeeeffff'
+ assert csrf._sanitize_token(token) == token
+
+ def test_st_rejects_overlong_token(self):
+ token = 'ddddeeeeaaaaddddbbbbeeeeeeeefffff'
+ assert csrf._sanitize_token(token) is None
+
+ def test_st_rejects_underlong_token(self):
+ token = 'ddddeeeeaaaaddddbbbbeeeeeeeefff'
+ assert csrf._sanitize_token(token) is None
+
+ def test_st_rejects_goofy_token(self):
+ token = 'ddddeeeeaaaadddd bbbbeeeeeeeefff'
+ assert csrf._sanitize_token(token) is None
+
+
+ # integration tests
+
+ def test_no_csrf_cookie_gives_403(self):
+ r = self.client.POST('/', csrf_token=False, raise_immediately=False)
+ assert r.code == 403
+ assert "Bad CSRF cookie" in r.body
+ assert b'csrf_token' in r.headers.cookie
+
+ def test_bad_csrf_cookie_gives_403(self):
+ r = self.client.POST('/', csrf_token=b'bad_token', raise_immediately=False)
+ assert r.code == 403
+ assert "Bad CSRF cookie" in r.body
+ assert r.headers.cookie[b'csrf_token'].value != 'bad_token'
+
+ def test_csrf_cookie_set_for_most_requests(self):
+ r = self.client.GET('/about/')
+ assert b'csrf_token' in r.headers.cookie
+
+ def test_no_csrf_cookie_set_for_assets(self):
+ r = self.client.GET('/assets/gratipay.css')
+ assert b'csrf_token' not in r.headers.cookie