Changeset 10414

Timestamp:

7 Jul 2013, 08:42:04 (11 years ago)

Author:

uli

Message:

Add function to delete set cookie.

Location:

main/waeup.cas/trunk/waeup/cas

Files:

• server.py (modified) (2 diffs)
• tests/test_server.py (modified) (2 diffs)

main/waeup.cas/trunk/waeup/cas/server.py

@@ -1 +1 @@
 """A WSGI app for serving CAS.
 """
+import datetime
 import os
 import random
@@ -97 +98 @@
     response.set_cookie(
         'cas-tgc', tgc.value, path='/', secure=True, httponly=True)
+    return response
+
+
+def delete_session_cookie(db, response, old_value=None):
+    """Delete session cookie.
+
+    Sets cookie with expiration date in past and deletes respective
+    entry from database.
+    """
+    if old_value is not None:
+        # delete old tgc from db
+        q = db.query(TicketGrantingCookie).filter(
+            TicketGrantingCookie.value == old_value)
+        result = list(q)
+        if len(result) == 1:
+            db.delete(result[0])
+    response.set_cookie(
+        'cas-tgc', '', path='/', secure=True, httponly=True,
+        expires=datetime.datetime(1970, 1, 1, 0, 0, 0))
     return response
 

main/waeup.cas/trunk/waeup/cas/tests/test_server.py

@@ -12 +12 @@
     CASServer, create_service_ticket, create_login_ticket,
     create_tgc_value, check_login_ticket, set_session_cookie,
-    check_session_cookie, get_template,
+    check_session_cookie, get_template, delete_session_cookie,
     )
 
 RE_ALPHABET = re.compile('^[a-zA-Z0-9\-]*$')
 RE_COOKIE = re.compile('^cas-tgc=[A-Za-z0-9\-]+; Path=/; secure; HttpOnly$')
+RE_COOKIE_DEL = re.compile(
+    '^cas-tgc=; Max-Age=\-[0-9]+; Path=/; '
+    'expires=Thu, 01-Jan-1970 00:00:00 GMT; secure; HttpOnly$')
 
 
@@ -424 +427 @@
         assert get_template('not-existing-template') is None
         assert get_template('login.html') is not None
+
+    def test_delete_session_cookie(self):
+        # we can unset cookies
+        db = DB('sqlite:///')
+        tgc = create_tgc_value()
+        db.add(tgc)
+        value = tgc.value
+        resp = delete_session_cookie(db, Response(), old_value=value)
+        assert 'Set-Cookie' in resp.headers
+        cookie = resp.headers['Set-Cookie']
+        assert RE_COOKIE_DEL.match(cookie), (
+            'Cookie in unexpected format: %s' % cookie)
+        # the cookie values was deleted from database
+        q = db.query(TicketGrantingCookie).filter(
+            TicketGrantingCookie.value == value)
+        assert len(list(q)) == 0