forked from Rockachopa/Timmy-time-dashboard
3a8496a3f1
Implements three security middleware components with full test coverage:
- CSRF Protection: Token generation/validation, safe method allowlist,
auto-exempt webhooks, constant-time comparison for timing attack prevention
- Security Headers: X-Content-Type-Options, X-Frame-Options, CSP,
Permissions-Policy, Referrer-Policy, HSTS (production)
- Request Logging: Method/path/status/duration logging with correlation IDs,
configurable path exclusions, X-Forwarded-For support
Also fixes Discord test isolation issue where settings.discord_token
was not being properly reset between tests.
New files:
- src/dashboard/middleware/{csrf,security_headers,request_logging}.py
- tests/dashboard/middleware/test_{csrf,security_headers,request_logging}.py
Addresses design review recommendations R3, R8, R9, R4.
All tests pass: 1950 passed, 40 skipped
Co-authored-by: Alexander Payne <apayne@MM.local>
138 lines
4.7 KiB
Python
138 lines
4.7 KiB
Python
"""Tests for CSRF protection middleware."""
|
|
|
|
import pytest
|
|
from fastapi import FastAPI, Request
|
|
from fastapi.responses import JSONResponse
|
|
from fastapi.testclient import TestClient
|
|
|
|
|
|
class TestCSRFMiddleware:
|
|
"""Test CSRF token validation and generation."""
|
|
|
|
def test_csrf_token_generation(self):
|
|
"""CSRF token should be generated and stored in session/state."""
|
|
from dashboard.middleware.csrf import generate_csrf_token
|
|
|
|
token1 = generate_csrf_token()
|
|
token2 = generate_csrf_token()
|
|
|
|
# Tokens should be non-empty strings
|
|
assert isinstance(token1, str)
|
|
assert len(token1) > 0
|
|
|
|
# Each token should be unique
|
|
assert token1 != token2
|
|
|
|
def test_csrf_token_validation(self):
|
|
"""Valid CSRF tokens should pass validation."""
|
|
from dashboard.middleware.csrf import generate_csrf_token, validate_csrf_token
|
|
|
|
token = generate_csrf_token()
|
|
|
|
# Same token should validate
|
|
assert validate_csrf_token(token, token) is True
|
|
|
|
# Different tokens should not validate
|
|
assert validate_csrf_token(token, "different-token") is False
|
|
|
|
# Empty tokens should not validate
|
|
assert validate_csrf_token(token, "") is False
|
|
assert validate_csrf_token("", token) is False
|
|
|
|
def test_csrf_middleware_allows_safe_methods(self):
|
|
"""GET, HEAD, OPTIONS requests should not require CSRF token."""
|
|
from dashboard.middleware.csrf import CSRFMiddleware
|
|
|
|
app = FastAPI()
|
|
app.add_middleware(CSRFMiddleware, secret="test-secret")
|
|
|
|
@app.get("/test")
|
|
def test_endpoint():
|
|
return {"message": "success"}
|
|
|
|
client = TestClient(app)
|
|
|
|
# GET should work without CSRF token
|
|
response = client.get("/test")
|
|
assert response.status_code == 200
|
|
assert response.json() == {"message": "success"}
|
|
|
|
def test_csrf_middleware_blocks_unsafe_methods_without_token(self):
|
|
"""POST, PUT, DELETE should require CSRF token."""
|
|
from dashboard.middleware.csrf import CSRFMiddleware
|
|
|
|
app = FastAPI()
|
|
app.add_middleware(CSRFMiddleware, secret="test-secret")
|
|
|
|
@app.post("/test")
|
|
def test_endpoint():
|
|
return {"message": "success"}
|
|
|
|
client = TestClient(app)
|
|
|
|
# POST without CSRF token should fail
|
|
response = client.post("/test")
|
|
assert response.status_code == 403
|
|
assert "csrf" in response.json().get("error", "").lower()
|
|
|
|
def test_csrf_middleware_allows_with_valid_token(self):
|
|
"""POST with valid CSRF token should succeed."""
|
|
from dashboard.middleware.csrf import CSRFMiddleware, generate_csrf_token
|
|
|
|
app = FastAPI()
|
|
app.add_middleware(CSRFMiddleware, secret="test-secret")
|
|
|
|
@app.post("/test")
|
|
def test_endpoint():
|
|
return {"message": "success"}
|
|
|
|
client = TestClient(app)
|
|
|
|
# Get CSRF token from cookie or header
|
|
token = generate_csrf_token()
|
|
|
|
# POST with valid CSRF token
|
|
response = client.post(
|
|
"/test",
|
|
headers={"X-CSRF-Token": token},
|
|
cookies={"csrf_token": token}
|
|
)
|
|
assert response.status_code == 200
|
|
assert response.json() == {"message": "success"}
|
|
|
|
def test_csrf_middleware_exempt_routes(self):
|
|
"""Routes with webhook patterns should bypass CSRF validation."""
|
|
from dashboard.middleware.csrf import CSRFMiddleware
|
|
|
|
app = FastAPI()
|
|
app.add_middleware(CSRFMiddleware, secret="test-secret")
|
|
|
|
@app.post("/webhook")
|
|
def webhook_endpoint():
|
|
return {"message": "webhook received"}
|
|
|
|
client = TestClient(app)
|
|
|
|
# POST to exempt route without CSRF token should work
|
|
response = client.post("/webhook")
|
|
assert response.status_code == 200
|
|
assert response.json() == {"message": "webhook received"}
|
|
|
|
def test_csrf_token_in_cookie(self):
|
|
"""CSRF token should be set in cookie for frontend to read."""
|
|
from dashboard.middleware.csrf import CSRFMiddleware
|
|
|
|
app = FastAPI()
|
|
app.add_middleware(CSRFMiddleware, secret="test-secret")
|
|
|
|
@app.get("/test")
|
|
def test_endpoint():
|
|
return {"message": "success"}
|
|
|
|
client = TestClient(app)
|
|
|
|
# GET should set CSRF cookie
|
|
response = client.get("/test")
|
|
assert response.status_code == 200
|
|
assert "csrf_token" in response.cookies or "set-cookie" in str(response.headers).lower()
|