FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

TST: Fix test_websocket_rejects_cross_origin on latest tornado by QuLogic · Pull Request #32516 · matplotlib/matplotlib · GitHub

Repository navigation

TST: Fix test_websocket_rejects_cross_origin on latest tornado - #32516

Merged
timhoffm merged 3 commits into
matplotlib:mainfrom
QuLogic:fix-ws-cors-test
Oct 22, 2026
Merged

timhoffm merged 3 commits into
matplotlib:mainfrom
QuLogic:fix-ws-cors-test

Conversation

QuLogic commented Oct 21, 2026

Copy link
Copy Markdown
Member

PR summary

There's no need to go through the non-standard __new__ instead of the normal constructor.

AI Disclosure

None

PR quality check

  • Use an expressive title, e.g. "Fix title font property precedence"
  • New and changed code is tested
  • [n/a] Plotting related features are demonstrated in an example
  • [n/a] New features and API changes have release notes
  • [n/a] Documentation complies with general and docstring guidelines

There's no need to go through the non-standard `__new__` instead of the
normal constructor.
QuLogic added this to the v3.11.3 milestone Oct 21, 2026

QuLogic commented Oct 21, 2026

Copy link
Copy Markdown
Member Author

Note, this fixes the exception, but 3 of the origins now fail. I will investigate that now.

QuLogic commented Oct 21, 2026

Copy link
Copy Markdown
Member Author

In 6.6, we have this change to check_origin:

This method is no longer called for requests that can be determined to be same-origin (including via the Sec-Fetch-Site header). The default implementation now calls .RequestHandler.check_trusted_origin (which uses the trusted_origins application setting); the comparison of the Origin and Host headers is performed before this method is called.

And the failing tests are all where Origin == Host and thus should pass, but since this is checked elsewhere, check_origin no longer bothers to allow it. This checking is in a private method, so I think it might be best to just drop these cases.

Tornado 6.6 changed how this works internally, and now
`WebSocket.check_origin` does not accept origin==host, which is checked
prior in a private method.

This test is mainly just to confirm that everything is working as
expected for invalid requests, so just drop the valid ones instead of
trying work around the new behaviour.
QuLogic linked an issue Oct 21, 2026 that may be closed by this pull request
QuLogic marked this pull request as ready for review October 21, 2026 22:52
example.com (while real) is specifically designated for documentation, not
testing, but we don't actually connect to it.

Co-authored-by: Ricci Adams <1097294+iccir@users.noreply.github.com>
timhoffm merged commit f53bde8 into matplotlib:main Oct 22, 2026
39 of 44 checks passed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[TST] Upcoming dependency test failures

3 participants


Back | FazBrowse Home | New Git URL