sneak
21642900e6
All checks were successful
Check / check (pull_request) Successful in 3m10s
Replace every httptest.NewRequest call with httptest.NewRequestWithContext using the test's t.Context(). Thread t *testing.T through the createSetupFormRequest and createLoginFormRequest helpers so they can supply a context. make lint under golangci-lint 2.12.2 drops from 94 findings to 47 (remaining: 23 gosec, 24 goconst, tracked in #176/#177/#178). make test and make fmt-check pass unchanged. Closes #175
82 lines
2.2 KiB
Go
82 lines
2.2 KiB
Go
package middleware //nolint:testpackage // tests internal CORS behavior
|
|
|
|
import (
|
|
"log/slog"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
|
|
"sneak.berlin/go/upaas/internal/config"
|
|
)
|
|
|
|
//nolint:gosec // test credentials
|
|
func newCORSTestMiddleware(corsOrigins string) *Middleware {
|
|
return &Middleware{
|
|
log: slog.Default(),
|
|
params: &Params{
|
|
Config: &config.Config{
|
|
CORSOrigins: corsOrigins,
|
|
SessionSecret: "test-secret-32-bytes-long-enough",
|
|
},
|
|
},
|
|
}
|
|
}
|
|
|
|
func TestCORS_NoOriginsConfigured_NoCORSHeaders(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
m := newCORSTestMiddleware("")
|
|
handler := m.CORS()(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
|
|
w.WriteHeader(http.StatusOK)
|
|
}))
|
|
|
|
req := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/", nil)
|
|
req.Header.Set("Origin", "https://evil.com")
|
|
|
|
rec := httptest.NewRecorder()
|
|
handler.ServeHTTP(rec, req)
|
|
|
|
assert.Empty(t, rec.Header().Get("Access-Control-Allow-Origin"),
|
|
"expected no CORS headers when no origins configured")
|
|
}
|
|
|
|
func TestCORS_OriginsConfigured_AllowsMatchingOrigin(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
m := newCORSTestMiddleware("https://app.example.com,https://other.example.com")
|
|
handler := m.CORS()(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
|
|
w.WriteHeader(http.StatusOK)
|
|
}))
|
|
|
|
req := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/", nil)
|
|
req.Header.Set("Origin", "https://app.example.com")
|
|
|
|
rec := httptest.NewRecorder()
|
|
handler.ServeHTTP(rec, req)
|
|
|
|
assert.Equal(t, "https://app.example.com",
|
|
rec.Header().Get("Access-Control-Allow-Origin"))
|
|
assert.Equal(t, "true",
|
|
rec.Header().Get("Access-Control-Allow-Credentials"))
|
|
}
|
|
|
|
func TestCORS_OriginsConfigured_RejectsNonMatchingOrigin(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
m := newCORSTestMiddleware("https://app.example.com")
|
|
handler := m.CORS()(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
|
|
w.WriteHeader(http.StatusOK)
|
|
}))
|
|
|
|
req := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/", nil)
|
|
req.Header.Set("Origin", "https://evil.com")
|
|
|
|
rec := httptest.NewRecorder()
|
|
handler.ServeHTTP(rec, req)
|
|
|
|
assert.Empty(t, rec.Header().Get("Access-Control-Allow-Origin"),
|
|
"expected no CORS headers for non-matching origin")
|
|
}
|