From 9ca831f816da8fbb1fa675691311a6cd1e6f3cf5 Mon Sep 17 00:00:00 2001 From: bruno Date: Wed, 28 Oct 2026 13:45:50 -0400 Subject: [PATCH] Tests CORS alertes : origine dev autorisee en preflight --- tests/test_draco_alertes.py | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/tests/test_draco_alertes.py b/tests/test_draco_alertes.py index 86c08f6..eafebbe 100644 --- a/tests/test_draco_alertes.py +++ b/tests/test_draco_alertes.py @@ -61,3 +61,9 @@ def test_notifications_api_et_cors_soeur(client): headers={"Origin": "https://evil.example", "Access-Control-Request-Method": "GET"}) assert "access-control-allow-origin" not in r4.headers + # Correctif 2026-10-28 : une origine sœur dev passe aussi. + r5 = client.options("/api/notifications", + headers={"Origin": "https://tiktak-dev.dracodev.net", + "Access-Control-Request-Method": "GET"}) + assert r5.headers.get("access-control-allow-origin") == "https://tiktak-dev.dracodev.net" + assert r5.headers.get("access-control-allow-credentials") == "true"