#33109: Testing of presence of SameSite and Secure cookies doesn't work
-------------------------------------+-------------------------------------
Reporter: Adrien | Owner: nobody
Carpentier |
Type: Bug | Status: new
Component: HTTP | Version: 3.1
handling | Keywords: cookies, samesite,
Severity: Normal | secure, test
Triage Stage: | Has patch: 0
Unreviewed |
Needs documentation: 0 | Needs tests: 0
Patch needs improvement: 0 | Easy pickings: 0
UI/UX: 0 |
-------------------------------------+-------------------------------------
When using the following constants in `settings.py`, as Django doc says
(https://docs.djangoproject.com/en/3.1/ref/settings/#std:setting-
SESSION_COOKIE_SECURE):
CSRF_COOKIE_SECURE = True
SESSION_COOKIE_SECURE = True
CSRF_COOKIE_SAMESITE = 'None'
SESSION_COOKIE_SAMESITE = 'None'
But when testing the presence of `SameSite` and `Secure` cookies in the
responses for , there is no `SameSite` neither `Secure` cookie keys. Here
is a non passing test, for example, for a user agent that should have
`SameSite` and `Secure` cookies:
agent_string = "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/80.0.2227.0 Safari/537.36"
from django.test import Client
test_client = Client()
res = test_client.get("/", HTTP_USER_AGENT=agent_string)
assert res.cookies.get(self.cookie_key)["samesite"] == "None"
assert res.cookies.get(self.cookie_key)["secure"]
When printing the content of the cookies (`print(res.cookies.items())`),
the cookie keys are not there.
(Until 3.1 I was adding `SameSite` and `Secure` cookies in the responses
through a custom middleware before Django 3.1, depending on the user
agent, with the exact same passing tests. Since Django 3.1, I just removed
the custom middleware and added those constants in `settings.py`).
--
Ticket URL: <https://code.djangoproject.com/ticket/33109>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/059.0f11c4f7905668c1156da48a948f2bed%40djangoproject.com.
