darkhelm/notifications-admin
1
0
Fork 0
mirror of https://github.com/GSA/notifications-admin.git synced 2026-07-23 17:39:13 -04:00
Code Issues Packages Projects Releases Wiki Activity
Files
d4c19140e8523fa532e3f2ebca2d4ec6b579ccdb
notifications-admin/tests/app/main/views/test_headers.py

55 lines
2.0 KiB
Python
Raw Normal View History

Automate counting of live services and orgs Returns the data calculated by the API. Stored in Redis against a hardcoded key so that no-one hammering the home page is directly hitting the database.
2019-04-10 17:20:51 +01:00
def test_owasp_useful_headers_set(
Replace uses of `client.get` and `client.post` We have a `client_request` fixture which does a bunch of useful stuff like: - checking the status code of the response - returning a `BeautifulSoup` object Lots of our tests still use an older fixture called `client`. This is not as good because it: - returns a raw `Response` object - doesn’t do the additional checks - means our tests contain a lot of repetetive boilerplate like `page = BeautifulSoup(response.data.decode('utf-8'), 'html.parser')` This commit converts all the tests which had a `client.get(…)` or `client.post(…)` statement to use their equivalents on `client_request` instead. Subsequent commits will remove uses of `client` in other tests, but doing it this way means the work can be broken up into more manageable chunks.
2022-01-04 15:40:42 +00:00
client_request,
Automate counting of live services and orgs Returns the data calculated by the API. Stored in Redis against a hardcoded key so that no-one hammering the home page is directly hitting the database.
2019-04-10 17:20:51 +01:00
mocker,
mock_get_service_and_organisation_counts,
):
Replace uses of `client.get` and `client.post` We have a `client_request` fixture which does a bunch of useful stuff like: - checking the status code of the response - returning a `BeautifulSoup` object Lots of our tests still use an older fixture called `client`. This is not as good because it: - returns a raw `Response` object - doesn’t do the additional checks - means our tests contain a lot of repetetive boilerplate like `page = BeautifulSoup(response.data.decode('utf-8'), 'html.parser')` This commit converts all the tests which had a `client.get(…)` or `client.post(…)` statement to use their equivalents on `client_request` instead. Subsequent commits will remove uses of `client` in other tests, but doing it this way means the work can be broken up into more manageable chunks.
2022-01-04 15:40:42 +00:00
client_request.logout()
response = client_request.get_response('.index')
Update emails to use logos cdn
2017-07-24 15:20:40 +01:00
Add some useful owasp suggested headers
2016-01-07 13:58:38 +00:00
assert response.headers['X-Frame-Options'] == 'deny'
assert response.headers['X-Content-Type-Options'] == 'nosniff'
assert response.headers['X-XSS-Protection'] == '1; mode=block'
Allow images to be served from live domain Currently images in our email template are hardcoded to be served from the live domain[1]. In order for the admin app, running locally or in preview/staging, to be able to load these images when previewing an email template, the CSP headers need to allow this domain. Also splits the header string up using string literal concatenation[2] so that it’s easier to read. 1. https://notifications.service.gov.uk 2. https://docs.python.org/3/reference/lexical_analysis.html#string-literal-concatenation
2016-07-05 07:12:21 +01:00
assert response.headers['Content-Security-Policy'] == (
Fix content security policy for the CDN The CDN URLs aren’t in included in the content security policy. So browsers will refuse to load them. This commit: - adds each of the CDN URLs to the - only prepend URLs in CSS files with `/static/` if we’re running locally (because the CDN URLs are like `static.example.com` not `example.com/static`)
2018-11-29 11:29:52 +00:00
"default-src 'self' static.example.com 'unsafe-inline';"
"script-src 'self' static.example.com *.google-analytics.com 'unsafe-inline' 'unsafe-eval' data:;"
Stop content security policy blocking GA In https://github.com/alphagov/notifications-admin/pull/1583 we changed our Google Analytics settings to use newer browsers’ `sendBeacon` feature. The advantage of this is that it > [ensures] that the data has been sent during the unloading of a > document [which] is something that has traditionally been difficult > for developers – https://developer.mozilla.org/en-US/docs/Web/API/Navigator/sendBeacon To transmit this data it uses a AJAX request (`XMLHttpRequest`) underneath. AJAX requests are governed by the `connect-src` content security policy (or the `default-src` if one is not present). `connect-src`: > Applies to XMLHttpRequest (AJAX), WebSocket or EventSource. If not > allowed the browser emulates a 400 HTTP status code. – https://content-security-policy.com/ Because we didn’t have one in place, `sendBeacon` requests to GA were getting blocked in browsers that support content security policy (pretty much everything better than IE11[1]). 1. https://caniuse.com/#feat=beacon
2017-11-06 10:25:30 +00:00
"connect-src 'self' *.google-analytics.com;"
Allow images to be served from live domain Currently images in our email template are hardcoded to be served from the live domain[1]. In order for the admin app, running locally or in preview/staging, to be able to load these images when previewing an email template, the CSP headers need to allow this domain. Also splits the header string up using string literal concatenation[2] so that it’s easier to read. 1. https://notifications.service.gov.uk 2. https://docs.python.org/3/reference/lexical_analysis.html#string-literal-concatenation
2016-07-05 07:12:21 +01:00
"object-src 'self';"
Fix content security policy for the CDN The CDN URLs aren’t in included in the content security policy. So browsers will refuse to load them. This commit: - adds each of the CDN URLs to the - only prepend URLs in CSS files with `/static/` if we’re running locally (because the CDN URLs are like `static.example.com` not `example.com/static`)
2018-11-29 11:29:52 +00:00
"font-src 'self' static.example.com data:;"
"img-src "
Add a map So you can check you’ve chosen the right areas, and to give you a clear idea of where the boundaries of an area are. The Javascript and CSS for the map is only loaded on this page because it adds quite a few kb, and we don’t want to be sending assets to the majority of our users who will never see them.
2020-07-06 10:53:14 +01:00
"'self' static.example.com *.tile.openstreetmap.org *.google-analytics.com"
" *.notifications.service.gov.uk static-logos.test.com data:;"
Serve video from a domain that doesn’t set cookies Then it’s one less cookie we have to get users to opt in to. We don’t derive any value from Youtube setting cookies. `youtube-nocookie.com` is a domain provided by Google for this purpose.
2019-12-19 13:43:44 +00:00
"frame-src 'self' www.youtube-nocookie.com;"
Allow images to be served from live domain Currently images in our email template are hardcoded to be served from the live domain[1]. In order for the admin app, running locally or in preview/staging, to be able to load these images when previewing an email template, the CSP headers need to allow this domain. Also splits the header string up using string literal concatenation[2] so that it’s easier to read. 1. https://notifications.service.gov.uk 2. https://docs.python.org/3/reference/lexical_analysis.html#string-literal-concatenation
2016-07-05 07:12:21 +01:00
)
Tell browser to connect to asset domain earlier When a browser loads a Notify page it does the following: - DNS and TLS handshake for notifications.service.gov.uk - download some HTML - sees that the HTML needs to load some CSS - DNS and TLS handshake for static.notifications.service.gov.uk - downloads the CSS We can speed things up a bit in modern browsers by parallelizing this process a bit. Modern browsers support some HTTP headers[1] that allow them to connect to other origins sooner. After this change the steps are: - DNS and TLS handshake for notifications.service.gov.uk - receive response headers and simultaneously: - download some HTML - DNS and TLS handshake for static.notifications.service.gov.uk - sees that the HTML needs to load some CSS - downloads the CSS 1. https://developer.mozilla.org/en-US/docs/Web/Performance/dns-prefetch
2020-12-03 10:52:25 +00:00
assert response.headers['Link'] == (
'<https://static.example.com>; rel=dns-prefetch, '
'<https://static.example.com>; rel=preconnect'
)
Bump utils and sanitise header values Updated notifications-utils. This brings in - the renamed character sanitization classes - the change to allow unicode in letter addresses (this lets us delete a test that is no longer relevant) Also replaced non-ascii characters in headers. This fixes a bug where non-ascii characters in a CSV filename were causing errors since the filename is also used in the header.
2018-05-25 10:18:39 +01:00
Automate counting of live services and orgs Returns the data calculated by the API. Stored in Redis against a hardcoded key so that no-one hammering the home page is directly hitting the database.
2019-04-10 17:20:51 +01:00
def test_headers_non_ascii_characters_are_replaced(
Replace uses of `client.get` and `client.post` We have a `client_request` fixture which does a bunch of useful stuff like: - checking the status code of the response - returning a `BeautifulSoup` object Lots of our tests still use an older fixture called `client`. This is not as good because it: - returns a raw `Response` object - doesn’t do the additional checks - means our tests contain a lot of repetetive boilerplate like `page = BeautifulSoup(response.data.decode('utf-8'), 'html.parser')` This commit converts all the tests which had a `client.get(…)` or `client.post(…)` statement to use their equivalents on `client_request` instead. Subsequent commits will remove uses of `client` in other tests, but doing it this way means the work can be broken up into more manageable chunks.
2022-01-04 15:40:42 +00:00
client_request,
Automate counting of live services and orgs Returns the data calculated by the API. Stored in Redis against a hardcoded key so that no-one hammering the home page is directly hitting the database.
2019-04-10 17:20:51 +01:00
mocker,
mock_get_service_and_organisation_counts,
):
Replace uses of `client.get` and `client.post` We have a `client_request` fixture which does a bunch of useful stuff like: - checking the status code of the response - returning a `BeautifulSoup` object Lots of our tests still use an older fixture called `client`. This is not as good because it: - returns a raw `Response` object - doesn’t do the additional checks - means our tests contain a lot of repetetive boilerplate like `page = BeautifulSoup(response.data.decode('utf-8'), 'html.parser')` This commit converts all the tests which had a `client.get(…)` or `client.post(…)` statement to use their equivalents on `client_request` instead. Subsequent commits will remove uses of `client` in other tests, but doing it this way means the work can be broken up into more manageable chunks.
2022-01-04 15:40:42 +00:00
client_request.logout()
Make logo CDN domain into simple config Having this as a function which does string parsing and manipulation surprised me a bit when I was trying to figure out why something wasn’t working. It’s more in line with the way we do other config like this (for example `ASSET_PATH`) to make it a simple config variable, rather than trying to be clever and guess things based on other config variables. It’s also less code, and is explicit enough that it doesn’t need tests.
2022-01-26 14:44:33 +00:00
mocker.patch.dict(
'app.current_app.config',
values={'LOGO_CDN_DOMAIN': 'static-logos۾.test.com'},
)
Bump utils and sanitise header values Updated notifications-utils. This brings in - the renamed character sanitization classes - the change to allow unicode in letter addresses (this lets us delete a test that is no longer relevant) Also replaced non-ascii characters in headers. This fixes a bug where non-ascii characters in a CSV filename were causing errors since the filename is also used in the header.
2018-05-25 10:18:39 +01:00
Replace uses of `client.get` and `client.post` We have a `client_request` fixture which does a bunch of useful stuff like: - checking the status code of the response - returning a `BeautifulSoup` object Lots of our tests still use an older fixture called `client`. This is not as good because it: - returns a raw `Response` object - doesn’t do the additional checks - means our tests contain a lot of repetetive boilerplate like `page = BeautifulSoup(response.data.decode('utf-8'), 'html.parser')` This commit converts all the tests which had a `client.get(…)` or `client.post(…)` statement to use their equivalents on `client_request` instead. Subsequent commits will remove uses of `client` in other tests, but doing it this way means the work can be broken up into more manageable chunks.
2022-01-04 15:40:42 +00:00
response = client_request.get_response('.index')
Bump utils and sanitise header values Updated notifications-utils. This brings in - the renamed character sanitization classes - the change to allow unicode in letter addresses (this lets us delete a test that is no longer relevant) Also replaced non-ascii characters in headers. This fixes a bug where non-ascii characters in a CSV filename were causing errors since the filename is also used in the header.
2018-05-25 10:18:39 +01:00
assert response.headers['Content-Security-Policy'] == (
Fix content security policy for the CDN The CDN URLs aren’t in included in the content security policy. So browsers will refuse to load them. This commit: - adds each of the CDN URLs to the - only prepend URLs in CSS files with `/static/` if we’re running locally (because the CDN URLs are like `static.example.com` not `example.com/static`)
2018-11-29 11:29:52 +00:00
"default-src 'self' static.example.com 'unsafe-inline';"
"script-src 'self' static.example.com *.google-analytics.com 'unsafe-inline' 'unsafe-eval' data:;"
Bump utils and sanitise header values Updated notifications-utils. This brings in - the renamed character sanitization classes - the change to allow unicode in letter addresses (this lets us delete a test that is no longer relevant) Also replaced non-ascii characters in headers. This fixes a bug where non-ascii characters in a CSV filename were causing errors since the filename is also used in the header.
2018-05-25 10:18:39 +01:00
"connect-src 'self' *.google-analytics.com;"
"object-src 'self';"
Fix content security policy for the CDN The CDN URLs aren’t in included in the content security policy. So browsers will refuse to load them. This commit: - adds each of the CDN URLs to the - only prepend URLs in CSS files with `/static/` if we’re running locally (because the CDN URLs are like `static.example.com` not `example.com/static`)
2018-11-29 11:29:52 +00:00
"font-src 'self' static.example.com data:;"
Add a map So you can check you’ve chosen the right areas, and to give you a clear idea of where the boundaries of an area are. The Javascript and CSS for the map is only loaded on this page because it adds quite a few kb, and we don’t want to be sending assets to the majority of our users who will never see them.
2020-07-06 10:53:14 +01:00
"img-src"
" 'self' static.example.com *.tile.openstreetmap.org *.google-analytics.com"
" *.notifications.service.gov.uk static-logos??.test.com data:;"
Serve video from a domain that doesn’t set cookies Then it’s one less cookie we have to get users to opt in to. We don’t derive any value from Youtube setting cookies. `youtube-nocookie.com` is a domain provided by Google for this purpose.
2019-12-19 13:43:44 +00:00
"frame-src 'self' www.youtube-nocookie.com;"
Bump utils and sanitise header values Updated notifications-utils. This brings in - the renamed character sanitization classes - the change to allow unicode in letter addresses (this lets us delete a test that is no longer relevant) Also replaced non-ascii characters in headers. This fixes a bug where non-ascii characters in a CSV filename were causing errors since the filename is also used in the header.
2018-05-25 10:18:39 +01:00
)
Reference in New Issue Copy Permalink