Skip to content
Open
Show file tree
Hide file tree
Changes from 2 commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions backend/apps/common/utils.py
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,7 @@
from django.template.defaultfilters import pluralize
from django.utils.text import Truncator
from django.utils.text import slugify as django_slugify
from django.views.decorators.csrf import csrf_exempt, csrf_protect
from humanize import intword, naturaltime

if TYPE_CHECKING:
Expand Down Expand Up @@ -67,6 +68,13 @@ def clean_url(url: str | None) -> str | None:
return url.strip().rstrip(".,;:!?") or None


def csrf_decorate(view):
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there a way to avoid settings based on the running environment? We want it to be as close to production as possible.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The last time I test sending fuzzing request in the fuzzing PR, it didn't work even with setting csrf header, but it was before a dedicated backend instance for e2e. I will remove this for now and try again in the fuzzing PR.

"""Apply CSRF protection based on settings."""
if settings.IS_E2E_ENVIRONMENT:
return csrf_exempt(view) # NOSONAR
return csrf_protect(view)


def get_absolute_url(path: str) -> str:
"""Return the absolute URL for a given path.

Expand Down
6 changes: 3 additions & 3 deletions backend/settings/urls.py
Original file line number Diff line number Diff line change
Expand Up @@ -8,10 +8,10 @@
from django.conf.urls.static import static
from django.contrib import admin
from django.urls import include, path
from django.views.decorators.csrf import csrf_protect
from strawberry.django.views import GraphQLView

from apps.api.rest.v0 import api as api_v0
from apps.common.utils import csrf_decorate
from apps.core.api.internal.algolia import algolia_search
from apps.core.api.internal.csrf import get_csrf_token
from apps.core.api.internal.status import get_status
Expand All @@ -21,8 +21,8 @@

urlpatterns = [
path("csrf/", get_csrf_token),
path("idx/", csrf_protect(algolia_search)),
path("graphql/", csrf_protect(GraphQLView.as_view(schema=schema, graphiql=settings.DEBUG))),
path("idx/", csrf_decorate(algolia_search)),
path("graphql/", csrf_decorate(GraphQLView.as_view(schema=schema, graphiql=settings.DEBUG))),
path("api/v0/", api_v0.urls),
path("a/", admin.site.urls),
path("owasp/", include(owasp_urls)),
Expand Down
6 changes: 6 additions & 0 deletions docker-compose/e2e.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,12 @@ services:
db:
condition: service_healthy
env_file: ../backend/.env.e2e.example
environment:
DJANGO_DB_HOST: db
DJANGO_DB_PORT: 5432
DJANGO_DB_NAME: ${DJANGO_DB_NAME:-nest_db_e2e}
DJANGO_DB_USER: ${DJANGO_DB_USER:-nest_user_e2e}
DJANGO_DB_PASSWORD: ${DJANGO_DB_PASSWORD:-nest_user_e2e_password}
networks:
- e2e-nest-network
ports:
Expand Down