web_test.py 文件源码

def test_cross_user(self):
        token2 = self.get_token()
        # Each token can be used to authenticate its own request.
        for token in (self.xsrf_token, token2):
            response = self.fetch(
                "/", method="POST",
                body=urllib_parse.urlencode(dict(_xsrf=token)),
                headers=self.cookie_headers(token))
            self.assertEqual(response.code, 200)
        # Sending one in the cookie and the other in the body is not allowed.
        for cookie_token, body_token in ((self.xsrf_token, token2),
                                         (token2, self.xsrf_token)):
            with ExpectLog(gen_log, '.*XSRF cookie does not match POST'):
                response = self.fetch(
                    "/", method="POST",
                    body=urllib_parse.urlencode(dict(_xsrf=body_token)),
                    headers=self.cookie_headers(cookie_token))
            self.assertEqual(response.code, 403)