54 lines
1.7 KiB
Go
54 lines
1.7 KiB
Go
package middleware
|
|
|
|
import (
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"testing"
|
|
)
|
|
|
|
func TestSecurityHeaders_DefaultPolicy(t *testing.T) {
|
|
handler := SecurityHeaders(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
w.WriteHeader(http.StatusOK)
|
|
}))
|
|
|
|
req := httptest.NewRequest(http.MethodGet, "/api/health", nil)
|
|
rec := httptest.NewRecorder()
|
|
handler.ServeHTTP(rec, req)
|
|
|
|
if got := rec.Header().Get("X-Content-Type-Options"); got != "nosniff" {
|
|
t.Errorf("expected nosniff, got %q", got)
|
|
}
|
|
if got := rec.Header().Get("X-Frame-Options"); got != "DENY" {
|
|
t.Errorf("expected DENY, got %q", got)
|
|
}
|
|
if got := rec.Header().Get("X-XSS-Protection"); got != "1; mode=block" {
|
|
t.Errorf("expected X-XSS-Protection, got %q", got)
|
|
}
|
|
if got := rec.Header().Get("Referrer-Policy"); got != "strict-origin-when-cross-origin" {
|
|
t.Errorf("expected Referrer-Policy, got %q", got)
|
|
}
|
|
if got := rec.Header().Get("Content-Security-Policy"); got != "default-src 'none'" {
|
|
t.Errorf("expected CSP default-src 'none', got %q", got)
|
|
}
|
|
if got := rec.Header().Get("Cache-Control"); got != "no-store, max-age=0" {
|
|
t.Errorf("expected Cache-Control no-store, got %q", got)
|
|
}
|
|
}
|
|
|
|
func TestSecurityHeaders_DocsPolicy(t *testing.T) {
|
|
handler := SecurityHeaders(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
w.WriteHeader(http.StatusOK)
|
|
}))
|
|
|
|
req := httptest.NewRequest(http.MethodGet, "/docs/index.html", nil)
|
|
rec := httptest.NewRecorder()
|
|
handler.ServeHTTP(rec, req)
|
|
|
|
csp := rec.Header().Get("Content-Security-Policy")
|
|
if csp == "" {
|
|
t.Fatal("expected CSP header for docs")
|
|
}
|
|
if csp == "default-src 'none'" {
|
|
t.Errorf("expected docs CSP to be more permissive, got %q", csp)
|
|
}
|
|
}
|