From e43e99a990febfd35a80d64c6656dd54086efd16 Mon Sep 17 00:00:00 2001
From: Kara Engelhardt <engelhardt@pretix.eu>
Date: Fri, 25 Sep 2026 16:37:02 +0200
Subject: [PATCH] Add test for ensure_csrf_cookie

---
 src/tests/multidomain/test_middlewares.py | 18 ++++++++++++++++++
 src/tests/testdummy/urls.py               |  2 ++
 2 files changed, 20 insertions(+)

diff --git a/src/tests/multidomain/test_middlewares.py b/src/tests/multidomain/test_middlewares.py
index 9fc488d41d..76d345e4f8 100644
--- a/src/tests/multidomain/test_middlewares.py
+++ b/src/tests/multidomain/test_middlewares.py
@@ -242,6 +242,24 @@ def test_cookie_domain_on_main_domain(env, client):
     assert r.client.cookies['pretix_session']['domain'] == ''
 
 
+@pytest.fixture
+def csrf_client():
+    from django.test import Client
+    return Client(enforce_csrf_checks=True)
+
+
+@pytest.mark.django_db
+@pytest.mark.parametrize("url", [
+    '/mrmcd/2015/',
+    '/ensure_csrf_cookie/',
+])
+def test_csrf_secure(env, url, csrf_client):
+    r = csrf_client.get(url, secure=True, HTTP_HOST='example.com')
+    assert 'pretix_csrftoken' not in r.client.cookies
+    assert '__Host-pretix_csrftoken' in r.client.cookies
+    assert r.client.cookies['__Host-pretix_csrftoken']['secure']
+
+
 @pytest.mark.django_db
 @override_settings(USE_X_FORWARDED_HOST=True)
 def test_with_forwarded_host(env, client):
diff --git a/src/tests/testdummy/urls.py b/src/tests/testdummy/urls.py
index c4abab3492..1762a45087 100644
--- a/src/tests/testdummy/urls.py
+++ b/src/tests/testdummy/urls.py
@@ -21,6 +21,7 @@
 #
 from django.http import HttpResponse
 from django.urls import path
+from django.views.decorators.csrf import ensure_csrf_cookie
 
 
 def view(request):
@@ -33,6 +34,7 @@ urlpatterns = [
         view,
         name="view",
     ),
+    path('ensure_csrf_cookie/', ensure_csrf_cookie(view)),
 ]
 
 organizer_patterns = [