def test_cors_allowed_origin_does_not_leak_between_credentialed_requests():
app = Starlette()
app.add_middleware(
- CORSMiddleware,
- allow_origins=["*"],
- allow_headers=["*"],
- allow_methods=["*"],
+ CORSMiddleware, allow_origins=["*"], allow_headers=["*"], allow_methods=["*"]
)
@app.route("/")
assert response.headers["access-control-allow-origin"] == "*"
response = client.get(
- "/",
- headers={"Cookie": "foo=bar", "Origin": "https://someplace.org"}
+ "/", headers={"Cookie": "foo=bar", "Origin": "https://someplace.org"}
)
- assert response.headers["access-control-allow-origin"] == "https://someplace.org" # noqa
+ assert response.headers["access-control-allow-origin"] == "https://someplace.org"
response = client.get("/", headers={"Origin": "https://someplace.org"})
assert response.headers["access-control-allow-origin"] == "*"