We don't have /callbacks/ anymore

gratipay/security/csrf.py

@@ -36,9 +36,8 @@ def extract_token_from_cookie(request):
         token = _sanitize_token(token)
 
     # Don't set a CSRF cookie on assets, to avoid busting the cache.
-    # Don't set it on callbacks, because we don't need it there.
 
-    if request.path.raw.startswith('/assets/') or request.path.raw.startswith('/callbacks/'):
+    if request.path.raw.startswith('/assets/'):
         token = None
     else:
         token = token or _get_new_token()
@@ -50,10 +49,6 @@ def reject_forgeries(request, csrf_token):
     # Assume that anything not defined as 'safe' by RC2616 needs protection.
     if request.line.method not in ('GET', 'HEAD', 'OPTIONS', 'TRACE'):
 
-        # But for webhooks we depend on IP filtering for security.
-        if request.line.uri.startswith('/callbacks/'):
-            return
-
         # Check non-cookie token for match.
         second_token = ""
         if request.line.method == "POST":

tests/py/test_security_csrf.py

@@ -47,3 +47,6 @@ def test_csrf_cookie_set_for_most_requests(self):
     def test_no_csrf_cookie_set_for_assets(self):
         r = self.client.GET('/assets/gratipay.css')
         assert b'csrf_token' not in r.headers.cookie
+
+    def test_that_missing_csrf_doesnt_confuse_whatever(self):
+        pass