opensource/galaxy
3
0
Fork 0
mirror of https://github.com/galaxyproject/galaxy.git synced 2026-10-16 07:19:13 +08:00
Code Issues Packages Projects Releases Wiki Activity

Assert WSGI-served pages send X-Frame-Options exactly once

Browse Source 
Pages that come through the legacy WSGI app currently get X-Frame-Options from both the WSGI transaction and the FastAPI middleware, so the existing published-page test only checked that SAMEORIGIN was somewhere in the value. Tighten it to an exact match and cover a couple more WSGI-served client routes, since requests joins repeated headers with a comma.
This commit is contained in:
Dannon Baker
2026-10-14 11:32:15 -04:00
parent d28efb94ed
commit 317d67f348
1 changed files with 8 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/galaxy_test/api/test_framework.py
+8 -2
View File
@@ -13,8 +13,14 @@ class TestApiFramework(ApiTestCase):
def test_xframe_options_on_non_embed_published(self):
get_response = self._get("/published/page")
# Pages served through the WSGI app currently get this from both the WSGI and FastAPI layers
assert "SAMEORIGIN" in get_response.headers["x-frame-options"]
assert get_response.headers["x-frame-options"] == "SAMEORIGIN"
def test_xframe_options_sent_once_on_wsgi_pages(self):
# requests joins repeated headers with ", ", so equality also catches duplicates
for path in ("/", "/histories/list"):
response = self._get(path)
self._assert_status_code_is(response, 200)
assert response.headers["x-frame-options"] == "SAMEORIGIN", path
def test_xframe_options_skipped_for_embed(self):
get_response = self._get("/published/page", data={"embed": "true"})