def test_create_app_does_not_add_report_to_headers(ndb_client):
app = factory.create_app("test")
client = app.test_client()
resp = client.get("/")
assert "Report-To" not in resp.headers
def test_create_app_creates_secret_key(ndb_client):
with mock.patch("secrets.token_urlsafe", return_value="topsecret"):
app = factory.create_app("test")
with ndb_client.context():
obj = factory.AppConfig.get_by_id(factory.AppConfig.SINGLETON_ID)
assert obj.secret_key == app.config["SECRET_KEY"]
assert app.config["SECRET_KEY"] == "topsecret"
def test_create_app_uses_existing_secret_key(ndb_client):
with ndb_client.context():
id_ = factory.AppConfig.SINGLETON_ID
factory.AppConfig(id=id_, secret_key="hunter2").put()
app = factory.create_app("test")
assert app.config["SECRET_KEY"] == "hunter2"
def test_create_app_adds_other_security_headers(ndb_client):
"""Useful security headers generated by flask-talisman."""
app = factory.create_app("test")
client = app.test_client()
response = client.get("/")
assert response.headers[
"Referrer-Policy"] == "strict-origin-when-cross-origin"
assert response.headers["X-Content-Type-Options"] == "nosniff"
assert response.headers["X-Frame-Options"] == "SAMEORIGIN"
assert response.headers["X-Xss-Protection"] == "1; mode=block"
def test_create_app_adds_csp_headers(ndb_client):
app = factory.create_app("test")
client = app.test_client()
resp = client.get("/")
expected = (
"font-src 'self' themes.googleusercontent.com *.gstatic.com; frame-src"
" 'self' www.google.com www.youtube.com; script-src 'self'"
" ajax.googleapis.com *.googleanalytics.com *.google-analytics.com;"
" style-src 'self' ajax.googleapis.com fonts.googleapis.com"
" *.gstatic.com; default-src 'self' *.gstatic.com")
assert resp.headers["Content-Security-Policy"] == expected
def test_given_flask_name(ndb_client):
app = factory.create_app("foo")
assert app.name == "foo"
def test_extra_flask_args(ndb_client):
app = factory.create_app("test", static_url_path="/foo")
assert app.static_url_path == "/foo"
def test_create_app_returns_an_app(ndb_client):
app = factory.create_app("test")
assert isinstance(app, Flask)