Just wondering if CSRF token should be also rotated when accessed via unittest client.
Middleware is in place and rotation happens via a browser.
Bug or intended behaviour, or perhaps a misuse ?
# Example
self.client = Client(enforce_csrf_checks=True)
resp = self.client.get(reverse('admin:login'))
csrf_token_from_cookie_pre_login = self.client.cookies['csrftoken'].value
credentials = {
'username': 'me',
'password': 'pass',
'csrfmiddlewaretoken': csrf_token_from_cookie_pre_login,
}
csrf_token_from_cookie_post_login = self.client.cookies['csrftoken'].value
self.assertNotEqual(csrf_token_from_cookie_post_login, csrf_token_from_cookie_pre_login)
# They are equal
Thanks,
Val