24 lines
682 B
Python
24 lines
682 B
Python
"""Security header behavior."""
|
|
|
|
from __future__ import annotations
|
|
|
|
from app import security
|
|
|
|
|
|
def test_csp_does_not_upgrade_http_when_proxy_not_trusted(app_client, monkeypatch):
|
|
monkeypatch.setattr(security.settings, "trust_proxy", False)
|
|
|
|
response = app_client.get("/healthz")
|
|
|
|
csp = response.headers["content-security-policy"]
|
|
assert "upgrade-insecure-requests" not in csp
|
|
|
|
|
|
def test_csp_upgrades_requests_when_proxy_is_trusted(app_client, monkeypatch):
|
|
monkeypatch.setattr(security.settings, "trust_proxy", True)
|
|
|
|
response = app_client.get("/healthz")
|
|
|
|
csp = response.headers["content-security-policy"]
|
|
assert "upgrade-insecure-requests" in csp
|