Repository: adamchainz/django-cors-headers

Issue:
test_get_replaces_referer_when_secure() failing under Django 1.11
Running the django-cors-headers test suite under Django 1.11a1 results in one test failure:
```
________________ RefererReplacementCorsMiddlewareTests.test_get_replaces_referer_when_secure _________________


self = <tests.test_middleware.RefererReplacementCorsMiddlewareTests testMethod=test_get_replaces_referer_when_secure>

    def test_get_replaces_referer_when_secure(self):
        resp = self.client.get(
            '/',
            HTTP_FAKE_SECURE='true',
            HTTP_HOST='example.com',
            HTTP_ORIGIN='https://example.org',
            HTTP_REFERER='https://example.org/foo'
        )
>       assert resp.wsgi_request.META['HTTP_REFERER'] == 'https://example.com/'
E       AssertionError: assert 'https://example.org/foo' == 'https://example.com/'
E         - https://example.org/foo
E         ?                  ^^ ---
E         + https://example.com/
E         ?                 + ^

tests/test_middleware.py:341: AssertionError
==================================== 1 failed, 57 passed in 3.80 seconds =====================================
```

See:
https://travis-ci.org/ottoyiu/django-cors-headers/builds/193731215#L328

Changes on Django's side that might be related:
https://github.com/django/django/commit/ddf169cdaca91e92dd5bfe6796bb6f38369ecb68
https://github.com/django/django/commit/7fe2d8d940fdddd1a02c4754008a27060c4a03e9


Discussion:

Resolving patch:
diff --git a/setup.py b/setup.py
--- a/setup.py
+++ b/setup.py
@@ -44,6 +44,7 @@ def get_version(package):
         'Framework :: Django :: 1.8',
         'Framework :: Django :: 1.9',
         'Framework :: Django :: 1.10',
+        'Framework :: Django :: 1.11',
         'Intended Audience :: Developers',
         'License :: OSI Approved :: MIT License',
         'Operating System :: OS Independent',


Test patch:
diff --git a/tests/settings.py b/tests/settings.py
--- a/tests/settings.py
+++ b/tests/settings.py
@@ -3,6 +3,8 @@
 
 SECRET_KEY = 'NOTASECRET'
 
+ALLOWED_HOSTS = ['*']
+
 INSTALLED_APPS = [
     'corsheaders',
     'tests.testapp',
diff --git a/tests/test_middleware.py b/tests/test_middleware.py
--- a/tests/test_middleware.py
+++ b/tests/test_middleware.py
@@ -348,6 +348,7 @@ def test_get_replaces_referer_when_secure(self):
             HTTP_ORIGIN='https://example.org',
             HTTP_REFERER='https://example.org/foo'
         )
+        assert resp.status_code == 200
         assert resp.wsgi_request.META['HTTP_REFERER'] == 'https://example.com/'
         assert resp.wsgi_request.META['ORIGINAL_HTTP_REFERER'] == 'https://example.org/foo'
 
@@ -360,6 +361,7 @@ def test_get_post_middleware_rereplaces_referer_when_secure(self):
             HTTP_ORIGIN='https://example.org',
             HTTP_REFERER='https://example.org/foo'
         )
+        assert resp.status_code == 200
         assert resp.wsgi_request.META['HTTP_REFERER'] == 'https://example.org/foo'
         assert 'ORIGINAL_HTTP_REFERER' not in resp.wsgi_request.META
 
@@ -370,6 +372,7 @@ def test_get_does_not_replace_referer_when_insecure(self):
             HTTP_ORIGIN='https://example.org',
             HTTP_REFERER='https://example.org/foo'
         )
+        assert resp.status_code == 200
         assert resp.wsgi_request.META['HTTP_REFERER'] == 'https://example.org/foo'
         assert 'ORIGINAL_HTTP_REFERER' not in resp.wsgi_request.META
 
@@ -382,6 +385,7 @@ def test_get_does_not_replace_referer_when_disabled(self):
             HTTP_ORIGIN='https://example.org',
             HTTP_REFERER='https://example.org/foo',
         )
+        assert resp.status_code == 200
         assert resp.wsgi_request.META['HTTP_REFERER'] == 'https://example.org/foo'
         assert 'ORIGINAL_HTTP_REFERER' not in resp.wsgi_request.META
 
@@ -392,6 +396,7 @@ def test_get_does_not_fail_in_referer_replacement_when_referer_missing(self):
             HTTP_HOST='example.com',
             HTTP_ORIGIN='https://example.org',
         )
+        assert resp.status_code == 200
         assert 'HTTP_REFERER' not in resp.wsgi_request.META
         assert 'ORIGINAL_HTTP_REFERER' not in resp.wsgi_request.META
 
@@ -402,6 +407,7 @@ def test_get_does_not_fail_in_referer_replacement_when_host_missing(self):
             HTTP_ORIGIN='https://example.org',
             HTTP_REFERER='https://example.org/foo',
         )
+        assert resp.status_code == 200
         assert resp.wsgi_request.META['HTTP_REFERER'] == 'https://example.org/foo'
         assert 'ORIGINAL_HTTP_REFERER' not in resp.wsgi_request.META
 
@@ -414,5 +420,6 @@ def test_get_does_not_replace_referer_when_not_valid_request(self):
             HTTP_ORIGIN='https://example.org',
             HTTP_REFERER='https://example.org/foo',
         )
+        assert resp.status_code == 200
         assert resp.wsgi_request.META['HTTP_REFERER'] == 'https://example.org/foo'
         assert 'ORIGINAL_HTTP_REFERER' not in resp.wsgi_request.META