CSRF header check now covers /login (exemption removed); login.html sends X-Aniweb

tests/test_api.py

@@ -297,8 +297,16 @@ def test_self_delete(base=BASE):
 
 def test_csrf_header_required(base=BASE):
     # mutation routes without the X-Aniweb header -> 403 (a cross-site form
-    # POST can't set it; the SPA always sends it). /login is exempt.
+    # POST can't set it; the SPA always sends it). /login included (was
+    # exempt): forced-login from an attacker's cross-site form is dead.
     jar = login("admin", "adminpw12345", base)
+    r = urllib.request.Request(base + "/login", method="POST",
+                               data=json.dumps({"username": "admin", "password": "x12345678"}).encode(),
+                               headers={"Content-Type": "application/json"})  # no X-Aniweb on purpose
+    try:
+        assert urllib.request.build_opener(urllib.request.HTTPCookieProcessor(jar)).open(r).status == 403
+    except urllib.error.HTTPError as e:
+        assert e.code == 403, e.code
     r = urllib.request.Request(base + "/logout", method="POST")
     try:
         assert urllib.request.build_opener(

tests/test_browser.py

@@ -114,7 +114,7 @@ async def _history_page_and_delete():
     op = urllib.request.build_opener(urllib.request.HTTPCookieProcessor(jar))
     op.open(urllib.request.Request(BASE + "/login",
               data=json.dumps({"username": "erin", "password": "erinpw12345"}).encode(),
-              headers={"Content-Type": "application/json"}, method="POST"))
+              headers={"Content-Type": "application/json", "X-Aniweb": "1"}, method="POST"))
     for n in range(1, 6):  # 5 entries: makes the home "history →" link render
         e = {"title": f"Hist {n}", "slug_id": f"hist-{n}", "season_id": n, "ep_id": n,
              "lang": "eng", "ep": n, "pos": 5, "dur": 600}
@@ -212,7 +212,7 @@ async def _recent_searches():
     op = urllib.request.build_opener(urllib.request.HTTPCookieProcessor(jar))
     op.open(urllib.request.Request(BASE + "/login",
               data=json.dumps({"username": "alice", "password": "alicepw12345"}).encode(),
-              headers={"Content-Type": "application/json"}, method="POST"))
+              headers={"Content-Type": "application/json", "X-Aniweb": "1"}, method="POST"))
     op.open(urllib.request.Request(BASE + "/api/searches",
               data=json.dumps({"q": "chainsaw"}).encode(),
               headers={"Content-Type": "application/json", "X-Aniweb": "1"}, method="POST"))