91 lines
2.8 KiB
Go
91 lines
2.8 KiB
Go
package middleware
|
|
|
|
import (
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"testing"
|
|
)
|
|
|
|
func TestCORSWithConfig_AllowsAllOrigins(t *testing.T) {
|
|
middleware := CORSWithConfig(CORSConfig{AllowedOrigins: []string{"*"}})
|
|
handler := middleware(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
w.WriteHeader(http.StatusOK)
|
|
}))
|
|
|
|
req := httptest.NewRequest(http.MethodGet, "/", nil)
|
|
rec := httptest.NewRecorder()
|
|
handler.ServeHTTP(rec, req)
|
|
|
|
if got := rec.Header().Get("Access-Control-Allow-Origin"); got != "*" {
|
|
t.Errorf("expected allow origin '*', got %q", got)
|
|
}
|
|
}
|
|
|
|
func TestCORSWithConfig_AllowsMatchingOrigin(t *testing.T) {
|
|
middleware := CORSWithConfig(CORSConfig{AllowedOrigins: []string{"https://example.com"}})
|
|
handler := middleware(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
w.WriteHeader(http.StatusOK)
|
|
}))
|
|
|
|
req := httptest.NewRequest(http.MethodGet, "/", nil)
|
|
req.Header.Set("Origin", "https://example.com")
|
|
rec := httptest.NewRecorder()
|
|
handler.ServeHTTP(rec, req)
|
|
|
|
if got := rec.Header().Get("Access-Control-Allow-Origin"); got != "https://example.com" {
|
|
t.Errorf("expected allow origin to match request, got %q", got)
|
|
}
|
|
if got := rec.Header().Get("Vary"); got != "Origin" {
|
|
t.Errorf("expected Vary header Origin, got %q", got)
|
|
}
|
|
}
|
|
|
|
func TestCORSWithConfig_BlocksUnknownOrigin(t *testing.T) {
|
|
middleware := CORSWithConfig(CORSConfig{AllowedOrigins: []string{"https://example.com"}})
|
|
handler := middleware(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
w.WriteHeader(http.StatusOK)
|
|
}))
|
|
|
|
req := httptest.NewRequest(http.MethodGet, "/", nil)
|
|
req.Header.Set("Origin", "https://unknown.com")
|
|
rec := httptest.NewRecorder()
|
|
handler.ServeHTTP(rec, req)
|
|
|
|
if got := rec.Header().Get("Access-Control-Allow-Origin"); got != "" {
|
|
t.Errorf("expected no allow origin header, got %q", got)
|
|
}
|
|
}
|
|
|
|
func TestCORSWithConfig_OptionsPreflight(t *testing.T) {
|
|
called := false
|
|
middleware := CORSWithConfig(CORSConfig{AllowedOrigins: []string{"*"}})
|
|
handler := middleware(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
called = true
|
|
w.WriteHeader(http.StatusOK)
|
|
}))
|
|
|
|
req := httptest.NewRequest(http.MethodOptions, "/", nil)
|
|
rec := httptest.NewRecorder()
|
|
handler.ServeHTTP(rec, req)
|
|
|
|
if rec.Code != http.StatusOK {
|
|
t.Errorf("expected 200 for preflight, got %d", rec.Code)
|
|
}
|
|
if called {
|
|
t.Error("expected handler not to be called for preflight")
|
|
}
|
|
}
|
|
|
|
func TestCORSWrapperAllowsAll(t *testing.T) {
|
|
handler := CORS(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
w.WriteHeader(http.StatusOK)
|
|
}))
|
|
|
|
req := httptest.NewRequest(http.MethodGet, "/", nil)
|
|
rec := httptest.NewRecorder()
|
|
handler.ServeHTTP(rec, req)
|
|
|
|
if got := rec.Header().Get("Access-Control-Allow-Origin"); got != "*" {
|
|
t.Errorf("expected allow origin '*', got %q", got)
|
|
}
|
|
}
|