[GitHub] [superset] ofekisr commented on a change in pull request #17468: chore: Add test for flask wtf csrf exempt config

[GitBox <gi...@apache.org>]

ofekisr commented on a change in pull request #17468:
URL: https://github.com/apache/superset/pull/17468#discussion_r752607177



##########
File path: tests/integration_tests/config_tests.py
##########
@@ -168,6 +168,17 @@ def test_full_setting(self):
         self.assertEqual(dttm_col.python_date_format, "epoch_s")
         self.assertEqual(dttm_col.expression, "CAST(dttm as INTEGER)")
 
+    def test_wtf_csrf_exempt_list(self):
+        # ensure that the exempt apis actually exist
+
+        # Derived from logic in flask-wtf:
+        # https://github.com/wtforms/flask-wtf/blob/v1.0.0/src/flask_wtf/csrf.py#L223-L224
+        all_view_functions = {
+            f"{view.__module__}.{view.__name__}" for view in app.view_functions.values()
+        }
+        for exempt_api in app.config["WTF_CSRF_EXEMPT_LIST"]:

Review comment:
       Rare use case, but you should check against the default config (superset.config) and not from the test config 
   




-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org



---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org