7
7
unset_jwt_cookies , unset_access_cookies , unset_refresh_cookies , jwt_optional
8
8
)
9
9
10
+
10
11
def _get_cookie_from_response (response , cookie_name ):
11
12
cookie_headers = response .headers .getlist ('Set-Cookie' )
12
13
for header in cookie_headers :
@@ -19,6 +20,7 @@ def _get_cookie_from_response(response, cookie_name):
19
20
return cookie
20
21
return None
21
22
23
+
22
24
@pytest .fixture (scope = 'function' )
23
25
def app ():
24
26
app = Flask (__name__ )
@@ -87,7 +89,7 @@ def optional_post_protected():
87
89
88
90
89
91
@pytest .mark .parametrize ("options" , [
90
- ('/refresh_token' , 'refresh_token_cookie' , '/refresh_protected' , '/delete_refresh_tokens' ),
92
+ ('/refresh_token' , 'refresh_token_cookie' , '/refresh_protected' , '/delete_refresh_tokens' ), # nopep8
91
93
('/access_token' , 'access_token_cookie' , '/protected' , '/delete_access_tokens' )
92
94
])
93
95
def test_jwt_refresh_required_with_cookies (app , options ):
@@ -200,7 +202,7 @@ def test_csrf_with_custom_header_names(app, options):
200
202
201
203
202
204
@pytest .mark .parametrize ("options" , [
203
- ('/refresh_token' , 'csrf_refresh_token' , '/refresh_protected' , '/post_refresh_protected' ),
205
+ ('/refresh_token' , 'csrf_refresh_token' , '/refresh_protected' , '/post_refresh_protected' ), # nopep8
204
206
('/access_token' , 'csrf_access_token' , '/protected' , '/post_protected' )
205
207
])
206
208
def test_custom_csrf_methods (app , options ):
@@ -412,6 +414,7 @@ def test_cookies_without_csrf(app):
412
414
refresh_cookie = _get_cookie_from_response (response , 'refresh_token_cookie' )
413
415
assert refresh_cookie is not None
414
416
417
+
415
418
def test_jwt_optional_with_csrf_enabled (app ):
416
419
test_client = app .test_client ()
417
420
@@ -423,7 +426,8 @@ def test_jwt_optional_with_csrf_enabled(app):
423
426
424
427
# User with a token should still get a CSRF error if csrf not present
425
428
response = test_client .get ('/access_token' )
426
- csrf_token = _get_cookie_from_response (response , 'csrf_access_token' )['csrf_access_token' ]
429
+ csrf_cookie = _get_cookie_from_response (response , 'csrf_access_token' )
430
+ csrf_token = csrf_cookie ['csrf_access_token' ]
427
431
response = test_client .post ('/optional_post_protected' )
428
432
assert response .status_code == 401
429
433
assert response .get_json () == {'msg' : 'Missing CSRF token in headers' }
0 commit comments