Carlos Florêncio
76 lines
2.4 KiB
Go
76 lines
2.4 KiB
Go
package backendapp
|
|
|
|
import (
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"testing"
|
|
|
|
"github.com/gin-gonic/gin"
|
|
)
|
|
|
|
func TestCORSMiddlewareEchoesOriginForCredentialedRequests(t *testing.T) {
|
|
gin.SetMode(gin.TestMode)
|
|
router := gin.New()
|
|
router.Use(corsMiddleware())
|
|
router.GET("/ping", func(c *gin.Context) {
|
|
c.String(http.StatusOK, "pong")
|
|
})
|
|
|
|
req := httptest.NewRequest(http.MethodGet, "/ping", nil)
|
|
req.Host = "localhost:38429"
|
|
req.Header.Set("Origin", "http://localhost:37429")
|
|
rec := httptest.NewRecorder()
|
|
router.ServeHTTP(rec, req)
|
|
|
|
if got := rec.Header().Get("Access-Control-Allow-Origin"); got != "http://localhost:37429" {
|
|
t.Fatalf("Access-Control-Allow-Origin = %q, want request origin", got)
|
|
}
|
|
if got := rec.Header().Get("Access-Control-Allow-Credentials"); got != "true" {
|
|
t.Fatalf("Access-Control-Allow-Credentials = %q, want true", got)
|
|
}
|
|
}
|
|
|
|
func TestCORSMiddlewareAllowsLoopbackAliasOriginForCredentialedRequests(t *testing.T) {
|
|
gin.SetMode(gin.TestMode)
|
|
router := gin.New()
|
|
router.Use(corsMiddleware())
|
|
router.GET("/ping", func(c *gin.Context) {
|
|
c.String(http.StatusOK, "pong")
|
|
})
|
|
|
|
req := httptest.NewRequest(http.MethodGet, "/ping", nil)
|
|
req.Host = "127.0.0.1:38429"
|
|
req.Header.Set("Origin", "http://localhost:37429")
|
|
rec := httptest.NewRecorder()
|
|
router.ServeHTTP(rec, req)
|
|
|
|
if got := rec.Header().Get("Access-Control-Allow-Origin"); got != "http://localhost:37429" {
|
|
t.Fatalf("Access-Control-Allow-Origin = %q, want loopback origin", got)
|
|
}
|
|
if got := rec.Header().Get("Access-Control-Allow-Credentials"); got != "true" {
|
|
t.Fatalf("Access-Control-Allow-Credentials = %q, want true", got)
|
|
}
|
|
}
|
|
|
|
func TestCORSMiddlewareRejectsCredentialedRequestsFromUnrelatedOrigins(t *testing.T) {
|
|
gin.SetMode(gin.TestMode)
|
|
router := gin.New()
|
|
router.Use(corsMiddleware())
|
|
router.GET("/ping", func(c *gin.Context) {
|
|
c.String(http.StatusOK, "pong")
|
|
})
|
|
|
|
req := httptest.NewRequest(http.MethodGet, "/ping", nil)
|
|
req.Host = "localhost:38429"
|
|
req.Header.Set("Origin", "https://example.invalid")
|
|
rec := httptest.NewRecorder()
|
|
router.ServeHTTP(rec, req)
|
|
|
|
if got := rec.Header().Get("Access-Control-Allow-Origin"); got != "" {
|
|
t.Fatalf("Access-Control-Allow-Origin = %q, want no credentialed CORS", got)
|
|
}
|
|
if got := rec.Header().Get("Access-Control-Allow-Credentials"); got != "" {
|
|
t.Fatalf("Access-Control-Allow-Credentials = %q, want no credentialed CORS", got)
|
|
}
|
|
}
|