tests/app/main/views/test_headers.py

from re import search


def test_owasp_useful_headers_set(
    client_request,
    mocker,
    mock_get_service_and_organisation_counts,
):
    client_request.logout()
    response = client_request.get_response('.index')

    assert response.headers['X-Frame-Options'] == 'deny'
    assert response.headers['X-Content-Type-Options'] == 'nosniff'
    assert response.headers['X-XSS-Protection'] == '1; mode=block'
    csp = response.headers['Content-Security-Policy']
    assert search(r"default-src 'self' static\.example\.com;", csp)
    assert search(r"frame-ancestors 'none';", csp)
    assert search(r"form-action 'self';", csp)
    assert search(
        r"script-src 'self' static\.example\.com 'unsafe-eval' https:\/\/js-agent\.newrelic\.com https:\/\/gov-bam\.nr-data\.net 'nonce-.*';", # noqa e501
        csp
    )
    assert search(r"connect-src 'self' https:\/\/gov-bam.nr-data\.net;", csp)
    assert search(r"style-src 'self' static\.example\.com 'nonce-.*';", csp)
    assert search(r"img-src 'self' static\.example\.com static-logos\.test\.com", csp)
Use csp nonces for inline scripts and styles 2023-03-07 16:08:51 -05:00			`from re import search`
Automate counting of live services and orgs Returns the data calculated by the API. Stored in Redis against a hardcoded key so that no-one hammering the home page is directly hitting the database. 2019-04-10 17:20:51 +01:00

			`def test_owasp_useful_headers_set(`
Replace uses of `client.get` and `client.post` We have a `client_request` fixture which does a bunch of useful stuff like: - checking the status code of the response - returning a `BeautifulSoup` object Lots of our tests still use an older fixture called `client`. This is not as good because it: - returns a raw `Response` object - doesn’t do the additional checks - means our tests contain a lot of repetetive boilerplate like `page = BeautifulSoup(response.data.decode('utf-8'), 'html.parser')` This commit converts all the tests which had a `client.get(…)` or `client.post(…)` statement to use their equivalents on `client_request` instead. Subsequent commits will remove uses of `client` in other tests, but doing it this way means the work can be broken up into more manageable chunks. 2022-01-04 15:40:42 +00:00			`client_request,`
Automate counting of live services and orgs Returns the data calculated by the API. Stored in Redis against a hardcoded key so that no-one hammering the home page is directly hitting the database. 2019-04-10 17:20:51 +01:00			`mocker,`
			`mock_get_service_and_organisation_counts,`
			`):`
Replace uses of `client.get` and `client.post` We have a `client_request` fixture which does a bunch of useful stuff like: - checking the status code of the response - returning a `BeautifulSoup` object Lots of our tests still use an older fixture called `client`. This is not as good because it: - returns a raw `Response` object - doesn’t do the additional checks - means our tests contain a lot of repetetive boilerplate like `page = BeautifulSoup(response.data.decode('utf-8'), 'html.parser')` This commit converts all the tests which had a `client.get(…)` or `client.post(…)` statement to use their equivalents on `client_request` instead. Subsequent commits will remove uses of `client` in other tests, but doing it this way means the work can be broken up into more manageable chunks. 2022-01-04 15:40:42 +00:00			`client_request.logout()`
			`response = client_request.get_response('.index')`
Update emails to use logos cdn 2017-07-24 15:20:40 +01:00
Add some useful owasp suggested headers 2016-01-07 13:58:38 +00:00			`assert response.headers['X-Frame-Options'] == 'deny'`
			`assert response.headers['X-Content-Type-Options'] == 'nosniff'`
			`assert response.headers['X-XSS-Protection'] == '1; mode=block'`
Use csp nonces for inline scripts and styles 2023-03-07 16:08:51 -05:00			`csp = response.headers['Content-Security-Policy']`
			`assert search(r"default-src 'self' static\.example\.com;", csp)`
Clean up CSP header, add Permissions-Policy header 2023-04-19 15:34:38 -04:00			`assert search(r"frame-ancestors 'none';", csp)`
			`assert search(r"form-action 'self';", csp)`
Use csp nonces for inline scripts and styles 2023-03-07 16:08:51 -05:00			`assert search(`
Clean up CSP header, add Permissions-Policy header 2023-04-19 15:34:38 -04:00			`r"script-src 'self' static\.example\.com 'unsafe-eval' https:\/\/js-agent\.newrelic\.com https:\/\/gov-bam\.nr-data\.net 'nonce-.*';", # noqa e501`
Use csp nonces for inline scripts and styles 2023-03-07 16:08:51 -05:00			`csp`
Bump utils and sanitise header values Updated notifications-utils. This brings in - the renamed character sanitization classes - the change to allow unicode in letter addresses (this lets us delete a test that is no longer relevant) Also replaced non-ascii characters in headers. This fixes a bug where non-ascii characters in a CSV filename were causing errors since the filename is also used in the header. 2018-05-25 10:18:39 +01:00			`)`
Clean up CSP header, add Permissions-Policy header 2023-04-19 15:34:38 -04:00			`assert search(r"connect-src 'self' https:\/\/gov-bam.nr-data\.net;", csp)`
Use csp nonces for inline scripts and styles 2023-03-07 16:08:51 -05:00			`assert search(r"style-src 'self' static\.example\.com 'nonce-.*';", csp)`
Clean up CSP header, add Permissions-Policy header 2023-04-19 15:34:38 -04:00			`assert search(r"img-src 'self' static\.example\.com static-logos\.test\.com", csp)`