#33109: Testing of presence of SameSite and Secure cookies doesn't work
-------------------------------------+-------------------------------------
Reporter: Adrien Carpentier | Owner: nobody
Type: Bug | Status: new
Component: HTTP handling | Version: 3.1
Severity: Normal | Resolution:
Keywords: cookies, samesite, | Triage Stage:
secure, test | Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
Description changed by Adrien Carpentier:
Old description:
> When using the following constants in `settings.py`, as Django doc says
> (https://docs.djangoproject.com/en/3.1/ref/settings/#std:setting-
> SESSION_COOKIE_SECURE):
>
> CSRF_COOKIE_SECURE = True
> SESSION_COOKIE_SECURE = True
> CSRF_COOKIE_SAMESITE = 'None'
> SESSION_COOKIE_SAMESITE = 'None'
>
> But when testing the presence of `SameSite` and `Secure` cookies in the
> responses for , there is no `SameSite` neither `Secure` cookie keys. Here
> is a non passing test, for example, for a user agent that should have
> `SameSite` and `Secure` cookies:
>
> agent_string = "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36
> (KHTML, like Gecko) Chrome/80.0.2227.0 Safari/537.36"
> from django.test import Client
> test_client = Client()
> res = test_client.get("/", HTTP_USER_AGENT=agent_string)
> assert res.cookies.get(self.cookie_key)["samesite"] == "None"
> assert res.cookies.get(self.cookie_key)["secure"]
>
> When printing the content of the cookies (`print(res.cookies.items())`),
> the cookie keys are not there.
>
> (Until 3.1 I was adding `SameSite` and `Secure` cookies in the responses
> through a custom middleware before Django 3.1, depending on the user
> agent, with the exact same passing tests. Since Django 3.1, I just
> removed the custom middleware and added those constants in
> `settings.py`).
New description:
When using the following constants in `settings.py`, as Django doc says
(https://docs.djangoproject.com/en/3.1/ref/settings/#std:setting-
SESSION_COOKIE_SECURE):
CSRF_COOKIE_SECURE = True
SESSION_COOKIE_SECURE = True
CSRF_COOKIE_SAMESITE = 'None'
SESSION_COOKIE_SAMESITE = 'None'
...and then when testing the presence of `SameSite` and `Secure` cookies
in the responses, there is no `SameSite` neither `Secure` cookie keys.
Here is a non passing test, for example, for a user agent that should have
`SameSite` and `Secure` cookies:
agent_string = "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/80.0.2227.0 Safari/537.36"
from django.test import Client
test_client = Client()
res = test_client.get("/", HTTP_USER_AGENT=agent_string)
assert res.cookies.get(self.cookie_key)["samesite"] == "None"
assert res.cookies.get(self.cookie_key)["secure"]
When printing the content of the cookies (`print(res.cookies.items())`),
the cookie keys are not there.
(Until 3.1 I was adding `SameSite` and `Secure` cookies in the responses
through a custom middleware before Django 3.1, depending on the user
agent, with the exact same passing tests. Since Django 3.1, I just removed
the custom middleware and added those constants in `settings.py`).
--
--
Ticket URL: <https://code.djangoproject.com/ticket/33109#comment:1>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/074.a3121dd6b79f433b580aa60a4c9ed1e6%40djangoproject.com.
