darkhelm/notifications-admin
1
0
Fork 0
mirror of https://github.com/GSA/notifications-admin.git synced 2026-04-24 11:11:15 -04:00
Code Issues Packages Projects Releases Wiki Activity
Files
71cbc00a3d0f802c4a6fe09201bfc6334e15728b
notifications-admin/tests/app/main/views/test_headers.py

54 lines
2.1 KiB
Python
Raw Normal View History

Automate counting of live services and orgs Returns the data calculated by the API. Stored in Redis against a hardcoded key so that no-one hammering the home page is directly hitting the database.
2019-04-10 17:20:51 +01:00
def test_owasp_useful_headers_set(
client,
mocker,
mock_get_service_and_organisation_counts,
):
Use named arguments for clearer string formatting Helps when the string is long. Also helps disambiguate between the CDN domain used for the logos and those for CSS/JS.
2018-11-29 11:41:13 +00:00
mocker.patch('app.get_logo_cdn_domain', return_value='static-logos.test.com')
Add some useful owasp suggested headers
2016-01-07 13:58:38 +00:00
Use `client` and `logged_in_client` fixtures Wherever possible, because Don’t Repeat Yourself.
2017-02-03 12:07:21 +00:00
response = client.get('/')
Update emails to use logos cdn
2017-07-24 15:20:40 +01:00
Add some useful owasp suggested headers
2016-01-07 13:58:38 +00:00
assert response.status_code == 200
assert response.headers['X-Frame-Options'] == 'deny'
assert response.headers['X-Content-Type-Options'] == 'nosniff'
assert response.headers['X-XSS-Protection'] == '1; mode=block'
Allow images to be served from live domain Currently images in our email template are hardcoded to be served from the live domain[1]. In order for the admin app, running locally or in preview/staging, to be able to load these images when previewing an email template, the CSP headers need to allow this domain. Also splits the header string up using string literal concatenation[2] so that it’s easier to read. 1. https://notifications.service.gov.uk 2. https://docs.python.org/3/reference/lexical_analysis.html#string-literal-concatenation
2016-07-05 07:12:21 +01:00
assert response.headers['Content-Security-Policy'] == (
Fix content security policy for the CDN The CDN URLs aren’t in included in the content security policy. So browsers will refuse to load them. This commit: - adds each of the CDN URLs to the - only prepend URLs in CSS files with `/static/` if we’re running locally (because the CDN URLs are like `static.example.com` not `example.com/static`)
2018-11-29 11:29:52 +00:00
"default-src 'self' static.example.com 'unsafe-inline';"
"script-src 'self' static.example.com *.google-analytics.com 'unsafe-inline' 'unsafe-eval' data:;"
Stop content security policy blocking GA In https://github.com/alphagov/notifications-admin/pull/1583 we changed our Google Analytics settings to use newer browsers’ `sendBeacon` feature. The advantage of this is that it > [ensures] that the data has been sent during the unloading of a > document [which] is something that has traditionally been difficult > for developers – https://developer.mozilla.org/en-US/docs/Web/API/Navigator/sendBeacon To transmit this data it uses a AJAX request (`XMLHttpRequest`) underneath. AJAX requests are governed by the `connect-src` content security policy (or the `default-src` if one is not present). `connect-src`: > Applies to XMLHttpRequest (AJAX), WebSocket or EventSource. If not > allowed the browser emulates a 400 HTTP status code. – https://content-security-policy.com/ Because we didn’t have one in place, `sendBeacon` requests to GA were getting blocked in browsers that support content security policy (pretty much everything better than IE11[1]). 1. https://caniuse.com/#feat=beacon
2017-11-06 10:25:30 +00:00
"connect-src 'self' *.google-analytics.com;"
Allow images to be served from live domain Currently images in our email template are hardcoded to be served from the live domain[1]. In order for the admin app, running locally or in preview/staging, to be able to load these images when previewing an email template, the CSP headers need to allow this domain. Also splits the header string up using string literal concatenation[2] so that it’s easier to read. 1. https://notifications.service.gov.uk 2. https://docs.python.org/3/reference/lexical_analysis.html#string-literal-concatenation
2016-07-05 07:12:21 +01:00
"object-src 'self';"
Fix content security policy for the CDN The CDN URLs aren’t in included in the content security policy. So browsers will refuse to load them. This commit: - adds each of the CDN URLs to the - only prepend URLs in CSS files with `/static/` if we’re running locally (because the CDN URLs are like `static.example.com` not `example.com/static`)
2018-11-29 11:29:52 +00:00
"font-src 'self' static.example.com data:;"
"img-src "
Add a map So you can check you’ve chosen the right areas, and to give you a clear idea of where the boundaries of an area are. The Javascript and CSS for the map is only loaded on this page because it adds quite a few kb, and we don’t want to be sending assets to the majority of our users who will never see them.
2020-07-06 10:53:14 +01:00
"'self' static.example.com *.tile.openstreetmap.org *.google-analytics.com"
" *.notifications.service.gov.uk static-logos.test.com data:;"
Serve video from a domain that doesn’t set cookies Then it’s one less cookie we have to get users to opt in to. We don’t derive any value from Youtube setting cookies. `youtube-nocookie.com` is a domain provided by Google for this purpose.
2019-12-19 13:43:44 +00:00
"frame-src 'self' www.youtube-nocookie.com;"
Allow images to be served from live domain Currently images in our email template are hardcoded to be served from the live domain[1]. In order for the admin app, running locally or in preview/staging, to be able to load these images when previewing an email template, the CSP headers need to allow this domain. Also splits the header string up using string literal concatenation[2] so that it’s easier to read. 1. https://notifications.service.gov.uk 2. https://docs.python.org/3/reference/lexical_analysis.html#string-literal-concatenation
2016-07-05 07:12:21 +01:00
)
Tell browser to connect to asset domain earlier When a browser loads a Notify page it does the following: - DNS and TLS handshake for notifications.service.gov.uk - download some HTML - sees that the HTML needs to load some CSS - DNS and TLS handshake for static.notifications.service.gov.uk - downloads the CSS We can speed things up a bit in modern browsers by parallelizing this process a bit. Modern browsers support some HTTP headers[1] that allow them to connect to other origins sooner. After this change the steps are: - DNS and TLS handshake for notifications.service.gov.uk - receive response headers and simultaneously: - download some HTML - DNS and TLS handshake for static.notifications.service.gov.uk - sees that the HTML needs to load some CSS - downloads the CSS 1. https://developer.mozilla.org/en-US/docs/Web/Performance/dns-prefetch
2020-12-03 10:52:25 +00:00
assert response.headers['Link'] == (
'<https://static.example.com>; rel=dns-prefetch, '
'<https://static.example.com>; rel=preconnect'
)
Bump utils and sanitise header values Updated notifications-utils. This brings in - the renamed character sanitization classes - the change to allow unicode in letter addresses (this lets us delete a test that is no longer relevant) Also replaced non-ascii characters in headers. This fixes a bug where non-ascii characters in a CSV filename were causing errors since the filename is also used in the header.
2018-05-25 10:18:39 +01:00
Automate counting of live services and orgs Returns the data calculated by the API. Stored in Redis against a hardcoded key so that no-one hammering the home page is directly hitting the database.
2019-04-10 17:20:51 +01:00
def test_headers_non_ascii_characters_are_replaced(
client,
mocker,
mock_get_service_and_organisation_counts,
):
Use named arguments for clearer string formatting Helps when the string is long. Also helps disambiguate between the CDN domain used for the logos and those for CSS/JS.
2018-11-29 11:41:13 +00:00
mocker.patch('app.get_logo_cdn_domain', return_value='static-logos۾.test.com')
Bump utils and sanitise header values Updated notifications-utils. This brings in - the renamed character sanitization classes - the change to allow unicode in letter addresses (this lets us delete a test that is no longer relevant) Also replaced non-ascii characters in headers. This fixes a bug where non-ascii characters in a CSV filename were causing errors since the filename is also used in the header.
2018-05-25 10:18:39 +01:00
response = client.get('/')
assert response.status_code == 200
assert response.headers['Content-Security-Policy'] == (
Fix content security policy for the CDN The CDN URLs aren’t in included in the content security policy. So browsers will refuse to load them. This commit: - adds each of the CDN URLs to the - only prepend URLs in CSS files with `/static/` if we’re running locally (because the CDN URLs are like `static.example.com` not `example.com/static`)
2018-11-29 11:29:52 +00:00
"default-src 'self' static.example.com 'unsafe-inline';"
"script-src 'self' static.example.com *.google-analytics.com 'unsafe-inline' 'unsafe-eval' data:;"
Bump utils and sanitise header values Updated notifications-utils. This brings in - the renamed character sanitization classes - the change to allow unicode in letter addresses (this lets us delete a test that is no longer relevant) Also replaced non-ascii characters in headers. This fixes a bug where non-ascii characters in a CSV filename were causing errors since the filename is also used in the header.
2018-05-25 10:18:39 +01:00
"connect-src 'self' *.google-analytics.com;"
"object-src 'self';"
Fix content security policy for the CDN The CDN URLs aren’t in included in the content security policy. So browsers will refuse to load them. This commit: - adds each of the CDN URLs to the - only prepend URLs in CSS files with `/static/` if we’re running locally (because the CDN URLs are like `static.example.com` not `example.com/static`)
2018-11-29 11:29:52 +00:00
"font-src 'self' static.example.com data:;"
Add a map So you can check you’ve chosen the right areas, and to give you a clear idea of where the boundaries of an area are. The Javascript and CSS for the map is only loaded on this page because it adds quite a few kb, and we don’t want to be sending assets to the majority of our users who will never see them.
2020-07-06 10:53:14 +01:00
"img-src"
" 'self' static.example.com *.tile.openstreetmap.org *.google-analytics.com"
" *.notifications.service.gov.uk static-logos??.test.com data:;"
Serve video from a domain that doesn’t set cookies Then it’s one less cookie we have to get users to opt in to. We don’t derive any value from Youtube setting cookies. `youtube-nocookie.com` is a domain provided by Google for this purpose.
2019-12-19 13:43:44 +00:00
"frame-src 'self' www.youtube-nocookie.com;"
Bump utils and sanitise header values Updated notifications-utils. This brings in - the renamed character sanitization classes - the change to allow unicode in letter addresses (this lets us delete a test that is no longer relevant) Also replaced non-ascii characters in headers. This fixes a bug where non-ascii characters in a CSV filename were causing errors since the filename is also used in the header.
2018-05-25 10:18:39 +01:00
)
Reference in New Issue Copy Permalink