63 lines
1.8 KiB
Go
63 lines
1.8 KiB
Go
package test
|
|
|
|
import (
|
|
"RenewCMS/api/middleware"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
func serveWithSecurityHeaders(hsts bool) http.Header {
|
|
handler := middleware.SecurityHeaders(hsts)(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
|
|
w.WriteHeader(http.StatusOK)
|
|
}))
|
|
rec := httptest.NewRecorder()
|
|
handler.ServeHTTP(rec, httptest.NewRequest(http.MethodGet, "/", nil))
|
|
return rec.Result().Header
|
|
}
|
|
|
|
func TestSecurityHeadersAlwaysSetBaseline(t *testing.T) {
|
|
headers := serveWithSecurityHeaders(false)
|
|
|
|
expected := map[string]string{
|
|
"X-Content-Type-Options": "nosniff",
|
|
"X-Frame-Options": "DENY",
|
|
"Referrer-Policy": "strict-origin-when-cross-origin",
|
|
"Cross-Origin-Opener-Policy": "same-origin",
|
|
}
|
|
for name, want := range expected {
|
|
if got := headers.Get(name); got != want {
|
|
t.Errorf("expected %s %q, got %q", name, want, got)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestSecurityHeadersContentSecurityPolicy(t *testing.T) {
|
|
csp := serveWithSecurityHeaders(false).Get("Content-Security-Policy")
|
|
|
|
for _, directive := range []string{
|
|
"default-src 'self'",
|
|
"script-src 'self';",
|
|
"object-src 'none'",
|
|
"base-uri 'self'",
|
|
"frame-ancestors 'none'",
|
|
} {
|
|
if !strings.Contains(csp, directive) {
|
|
t.Errorf("expected CSP to contain %q, got %q", directive, csp)
|
|
}
|
|
}
|
|
if strings.Contains(csp, "script-src 'self' 'unsafe") {
|
|
t.Errorf("script-src must not allow unsafe sources, got %q", csp)
|
|
}
|
|
}
|
|
|
|
func TestSecurityHeadersHSTSOnlyWhenEnabled(t *testing.T) {
|
|
if got := serveWithSecurityHeaders(false).Get("Strict-Transport-Security"); got != "" {
|
|
t.Errorf("expected no HSTS header, got %q", got)
|
|
}
|
|
if got := serveWithSecurityHeaders(true).Get("Strict-Transport-Security"); got != "max-age=31536000" {
|
|
t.Errorf("expected HSTS max-age=31536000, got %q", got)
|
|
}
|
|
}
|