(self)
| 2851 | self.assertEqual(len(tokens), NUM_TOKENS) |
| 2852 | |
| 2853 | def test_cross_user(self): |
| 2854 | token2 = self.get_token() |
| 2855 | # Each token can be used to authenticate its own request. |
| 2856 | for token in (self.xsrf_token, token2): |
| 2857 | response = self.fetch( |
| 2858 | "/", |
| 2859 | method="POST", |
| 2860 | body=urllib.parse.urlencode(dict(_xsrf=token)), |
| 2861 | headers=self.cookie_headers(token), |
| 2862 | ) |
| 2863 | self.assertEqual(response.code, 200) |
| 2864 | # Sending one in the cookie and the other in the body is not allowed. |
| 2865 | for cookie_token, body_token in ( |
| 2866 | (self.xsrf_token, token2), |
| 2867 | (token2, self.xsrf_token), |
| 2868 | ): |
| 2869 | with ExpectLog(gen_log, ".*XSRF cookie does not match POST"): |
| 2870 | response = self.fetch( |
| 2871 | "/", |
| 2872 | method="POST", |
| 2873 | body=urllib.parse.urlencode(dict(_xsrf=body_token)), |
| 2874 | headers=self.cookie_headers(cookie_token), |
| 2875 | ) |
| 2876 | self.assertEqual(response.code, 403) |
| 2877 | |
| 2878 | def test_refresh_token(self): |
| 2879 | token = self.xsrf_token |
nothing calls this directly
no test coverage detected