mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-10-24 06:06:09 +00:00
Code Issues 32 Releases Wiki Activity

Refs #27468 -- Made user sessions use SHA-256 algorithm.

Browse Source
This commit is contained in:
Mariusz Felisiak
2020-04-29 16:45:00 +02:00
committed by GitHub
parent 5869afe32b
commit 54646a423b
7 changed files with 57 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
tests/auth_tests/test_views.py
View File

@@ -10,7 +10,7 @@ from django.apps import apps
from django.conf import settings
from django.contrib.admin.models import LogEntry
from django.contrib.auth import (
BACKEND_SESSION_KEY, REDIRECT_FIELD_NAME, SESSION_KEY,
BACKEND_SESSION_KEY, HASH_SESSION_KEY, REDIRECT_FIELD_NAME, SESSION_KEY,
)
from django.contrib.auth.forms import (
AuthenticationForm, PasswordChangeForm, SetPasswordForm,
@@ -711,6 +711,27 @@ class LoginTest(AuthViewsTestCase):
self.login(password='foobar')
self.assertNotEqual(original_session_key, self.client.session.session_key)
def test_legacy_session_key_flushed_on_login(self):
# RemovedInDjango40Warning.
user = User.objects.get(username='testclient')
engine = import_module(settings.SESSION_ENGINE)
session = engine.SessionStore()
session[SESSION_KEY] = user.id
session[HASH_SESSION_KEY] = user._legacy_get_session_auth_hash()
session.save()
original_session_key = session.session_key
self.client.cookies[settings.SESSION_COOKIE_NAME] = original_session_key
# Legacy session key is flushed on login.
self.login()
self.assertNotEqual(original_session_key, self.client.session.session_key)
# Legacy session key is flushed after a password change.
user.set_password('password_2')
user.save()
original_session_key = session.session_key
self.client.cookies[settings.SESSION_COOKIE_NAME] = original_session_key
self.login(password='password_2')
self.assertNotEqual(original_session_key, self.client.session.session_key)
def test_login_session_without_hash_session_key(self):
"""
Session without django.contrib.auth.HASH_SESSION_KEY should login