19 lines
758 B
Python
19 lines
758 B
Python
|
# retoor <retoor@molodetz.nl>
|
||
|
|
|
||
|
|
import requests
|
||
|
|
from tests.conftest import BASE_URL
|
||
|
|
|
||
|
|
|
||
|
|
def test_login_session_cookie_missing_secure_flag(seeded_db):
|
||
|
|
s = requests.Session()
|
||
|
|
r = s.post(
|
||
|
|
f"{BASE_URL}/auth/login",
|
||
|
|
data={"email": "alice@test.devplace", "password": "secret123"},
|
||
|
|
allow_redirects=False,
|
||
|
|
)
|
||
|
|
set_cookie = r.headers.get("Set-Cookie", "")
|
||
|
|
assert "session=" in set_cookie, f"session cookie not found in Set-Cookie: {set_cookie}"
|
||
|
|
assert "HttpOnly" in set_cookie, f"HttpOnly not found in Set-Cookie: {set_cookie}"
|
||
|
|
assert "SameSite=Lax" in set_cookie, f"SameSite=Lax not found in Set-Cookie: {set_cookie}"
|
||
|
|
assert "Secure" not in set_cookie, f"Secure flag should be absent from Set-Cookie: {set_cookie}"
|