From 317d67f34855d13fd219713cfe15c8fe4e3ef2f5 Mon Sep 17 00:00:00 2001 From: Dannon Baker Date: Sun, 11 Oct 2026 17:47:36 -0400 Subject: [PATCH] Assert WSGI-served pages send X-Frame-Options exactly once Pages that come through the legacy WSGI app currently get X-Frame-Options from both the WSGI transaction and the FastAPI middleware, so the existing published-page test only checked that SAMEORIGIN was somewhere in the value. Tighten it to an exact match and cover a couple more WSGI-served client routes, since requests joins repeated headers with a comma. --- lib/galaxy_test/api/test_framework.py | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/lib/galaxy_test/api/test_framework.py b/lib/galaxy_test/api/test_framework.py index 3fa8dfce051..a411b157bfa 100644 --- a/lib/galaxy_test/api/test_framework.py +++ b/lib/galaxy_test/api/test_framework.py @@ -13,8 +13,14 @@ class TestApiFramework(ApiTestCase): def test_xframe_options_on_non_embed_published(self): get_response = self._get("/published/page") - # Pages served through the WSGI app currently get this from both the WSGI and FastAPI layers - assert "SAMEORIGIN" in get_response.headers["x-frame-options"] + assert get_response.headers["x-frame-options"] == "SAMEORIGIN" + + def test_xframe_options_sent_once_on_wsgi_pages(self): + # requests joins repeated headers with ", ", so equality also catches duplicates + for path in ("/", "/histories/list"): + response = self._get(path) + self._assert_status_code_is(response, 200) + assert response.headers["x-frame-options"] == "SAMEORIGIN", path def test_xframe_options_skipped_for_embed(self): get_response = self._get("/published/page", data={"embed": "true"})