| 289 | |
| 290 | |
| 291 | def test_session_using_session_settings(app, client): |
| 292 | app.config.update( |
| 293 | SERVER_NAME="www.example.com:8080", |
| 294 | APPLICATION_ROOT="/test", |
| 295 | SESSION_COOKIE_DOMAIN=".example.com", |
| 296 | SESSION_COOKIE_HTTPONLY=False, |
| 297 | SESSION_COOKIE_SECURE=True, |
| 298 | SESSION_COOKIE_PARTITIONED=True, |
| 299 | SESSION_COOKIE_SAMESITE="Lax", |
| 300 | SESSION_COOKIE_PATH="/", |
| 301 | ) |
| 302 | |
| 303 | @app.route("/") |
| 304 | def index(): |
| 305 | flask.session["testing"] = 42 |
| 306 | return "Hello World" |
| 307 | |
| 308 | @app.route("/clear") |
| 309 | def clear(): |
| 310 | flask.session.pop("testing", None) |
| 311 | return "Goodbye World" |
| 312 | |
| 313 | rv = client.get("/", "http://www.example.com:8080/test/") |
| 314 | cookie = rv.headers["set-cookie"].lower() |
| 315 | # or condition for Werkzeug < 2.3 |
| 316 | assert "domain=example.com" in cookie or "domain=.example.com" in cookie |
| 317 | assert "path=/" in cookie |
| 318 | assert "secure" in cookie |
| 319 | assert "httponly" not in cookie |
| 320 | assert "samesite" in cookie |
| 321 | assert "partitioned" in cookie |
| 322 | |
| 323 | rv = client.get("/clear", "http://www.example.com:8080/test/") |
| 324 | cookie = rv.headers["set-cookie"].lower() |
| 325 | assert "session=;" in cookie |
| 326 | # or condition for Werkzeug < 2.3 |
| 327 | assert "domain=example.com" in cookie or "domain=.example.com" in cookie |
| 328 | assert "path=/" in cookie |
| 329 | assert "secure" in cookie |
| 330 | assert "samesite" in cookie |
| 331 | assert "partitioned" in cookie |
| 332 | |
| 333 | |
| 334 | def test_session_using_samesite_attribute(app, client): |