penguinolog / urwid / 42196237926

93%

master: 94%

push

github

Require a token in the WebSocket example, and create it on start

On a loopback address every user of the host can connect, and a client
that is not a browser sends no Origin header to check, so the token is
now required everywhere:

- --token-file is a required argument; a non-loopback address also needs TLS.
- A missing token file is created with a new random token, mode 0600,
  never through an existing file or symbolic link; its path is logged, not the token.
- An existing token file is read only when it is a regular file of at most
  4 KiB, not reached through a symbolic link, owned by this user and private.
- The token file is read or created only after every other argument is valid.
- The docstring shows how to make a token file by hand.

6699 of 7382 branches covered (90.75%)

Branch coverage included in aggregate %.

17287 of 18349 relevant lines covered (94.21%)

14.94 hits per line