OPTIONS requests shouldn't be rate limited

[SemVerTsar]

Currently, refreshing a password reset request page (3 or more times) that does an OPTIONS to get fields, will block you from requesting the fields for a day.

We should only be rate limiting POST requests.

cc @meshy @ian-foote

[LilyFirefly]

This looks easy enough to do. We can check the request.method in the throttle's allow_request method. See the Custom Throttles example.

[mlen108]

[SemVerTsar]

@ian-foote or @meshy Please review.

[LilyFirefly]

Do you need to recreate the request each time?

[SemVerTsar]

Yes, as the request is being processed items are popped from the data structure. So the request cannot be reused.

[LilyFirefly]

Pity.

[LilyFirefly]

You could add a helper method to make this more DRY. Something like:

def check_post_rate_limit(self, view, data, expected_status):
    request = self.create_request('post', data=data, auth=False)
    response = view(request)
    self.assertEqual(response.status_code, expected_status)

[mlen108]

👍

[SemVerTsar]

@ian-foote Please take another look

[SemVerTsar]

I moved it out with a look to adapting check_post_rate_limit() to work with different request types

[SemVerTsar]

@meshy or @ian-foote could you take another look

[meshy]

Would assert_post_returns_status be more appropriate?

[SemVerTsar]

yes

[meshy]

👍

[SemVerTsar]

Update

[meshy]

Happy if travis is

[coveralls]

Coverage remained the same when pulling c418ca7 on options-rate-delimit into 54fb754 on master.

[coveralls]

Coverage remained the same when pulling c418ca7 on options-rate-delimit into 54fb754 on master.