Django must prevent caching of responses that set a user-specific (and maybe security sensitive) cookie in response to a cookie-less request.
(self)
| 2876 | self.assertEqual(response.content, b"Hello World 2") |
| 2877 | |
| 2878 | def test_sensitive_cookie_not_cached(self): |
| 2879 | """ |
| 2880 | Django must prevent caching of responses that set a user-specific (and |
| 2881 | maybe security sensitive) cookie in response to a cookie-less request. |
| 2882 | """ |
| 2883 | request = self.factory.get("/view/") |
| 2884 | csrf_middleware = CsrfViewMiddleware(csrf_view) |
| 2885 | csrf_middleware.process_view(request, csrf_view, (), {}) |
| 2886 | cache_middleware = CacheMiddleware(csrf_middleware) |
| 2887 | |
| 2888 | self.assertIsNone(cache_middleware.process_request(request)) |
| 2889 | cache_middleware(request) |
| 2890 | |
| 2891 | # Inserting a CSRF cookie in a cookie-less request prevented caching. |
| 2892 | self.assertIsNone(cache_middleware.process_request(request)) |
| 2893 | |
| 2894 | def test_304_response_has_http_caching_headers_but_not_cached(self): |
| 2895 | original_view = mock.Mock(return_value=HttpResponseNotModified()) |
nothing calls this directly
no test coverage detected