02847eea92
- Add CORSOrigins config field (UPAAS_CORS_ORIGINS env var) - Default to same-origin only (no CORS headers when unconfigured) - When configured, allow specified origins with AllowCredentials: true - Add tests for CORS middleware behavior
82 lines
2.2 KiB
Go
82 lines
2.2 KiB
Go
package middleware //nolint:testpackage // tests internal CORS behavior
|
|
|
|
import (
|
|
"log/slog"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
|
|
"git.eeqj.de/sneak/upaas/internal/config"
|
|
)
|
|
|
|
//nolint:gosec // test credentials
|
|
func newCORSTestMiddleware(corsOrigins string) *Middleware {
|
|
return &Middleware{
|
|
log: slog.Default(),
|
|
params: &Params{
|
|
Config: &config.Config{
|
|
CORSOrigins: corsOrigins,
|
|
SessionSecret: "test-secret-32-bytes-long-enough",
|
|
},
|
|
},
|
|
}
|
|
}
|
|
|
|
func TestCORS_NoOriginsConfigured_NoCORSHeaders(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
m := newCORSTestMiddleware("")
|
|
handler := m.CORS()(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
|
|
w.WriteHeader(http.StatusOK)
|
|
}))
|
|
|
|
req := httptest.NewRequest(http.MethodGet, "/", nil)
|
|
req.Header.Set("Origin", "https://evil.com")
|
|
|
|
rec := httptest.NewRecorder()
|
|
handler.ServeHTTP(rec, req)
|
|
|
|
assert.Empty(t, rec.Header().Get("Access-Control-Allow-Origin"),
|
|
"expected no CORS headers when no origins configured")
|
|
}
|
|
|
|
func TestCORS_OriginsConfigured_AllowsMatchingOrigin(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
m := newCORSTestMiddleware("https://app.example.com,https://other.example.com")
|
|
handler := m.CORS()(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
|
|
w.WriteHeader(http.StatusOK)
|
|
}))
|
|
|
|
req := httptest.NewRequest(http.MethodGet, "/", nil)
|
|
req.Header.Set("Origin", "https://app.example.com")
|
|
|
|
rec := httptest.NewRecorder()
|
|
handler.ServeHTTP(rec, req)
|
|
|
|
assert.Equal(t, "https://app.example.com",
|
|
rec.Header().Get("Access-Control-Allow-Origin"))
|
|
assert.Equal(t, "true",
|
|
rec.Header().Get("Access-Control-Allow-Credentials"))
|
|
}
|
|
|
|
func TestCORS_OriginsConfigured_RejectsNonMatchingOrigin(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
m := newCORSTestMiddleware("https://app.example.com")
|
|
handler := m.CORS()(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
|
|
w.WriteHeader(http.StatusOK)
|
|
}))
|
|
|
|
req := httptest.NewRequest(http.MethodGet, "/", nil)
|
|
req.Header.Set("Origin", "https://evil.com")
|
|
|
|
rec := httptest.NewRecorder()
|
|
handler.ServeHTTP(rec, req)
|
|
|
|
assert.Empty(t, rec.Header().Get("Access-Control-Allow-Origin"),
|
|
"expected no CORS headers for non-matching origin")
|
|
}
|