search

swsnu / swppfall2021

Learning Software Engineering By Building Web Services
28 stars 19 forks source link

[hw4] question about testing #127

Open dooly9931 opened 3 years ago

dooly9931 commented 3 years ago

We have test_csrf provided in our tests.py to test csrf token working. Can I consider csrf related things as tested? And therefore, is it okay not to check csrf related problems when writing test codes for other API methods? (such as using client = Client(enforce_csrf_checks=True))

ttoru96 commented 3 years ago

It is okay not to check CSRF related problems when writing test codes for other API methods, as long as you have test codes for csrf_token in some other tests.

By the way, if you give True value to enforce_csrf_checks, you are creating a client that does CSRF check. If you intend not to perform CSRF check, you should give False instead.