-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathcors_test.go
More file actions
104 lines (87 loc) · 2.94 KB
/
Copy pathcors_test.go
File metadata and controls
104 lines (87 loc) · 2.94 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
package test
import (
"net/http"
"net/http/httptest"
"testing"
"github.com/gin-gonic/gin"
"github.com/humanjuan/golyn/config/loaders"
"github.com/humanjuan/golyn/globals"
"github.com/humanjuan/golyn/middlewares"
)
func TestCorsMiddleware(t *testing.T) {
gin.SetMode(gin.TestMode)
// Setup mock logger
logDir := t.TempDir()
log, _ := loaders.InitLog("test_cors", logDir, "debug", 5, 1, false)
globals.SetAppLogger(log)
defer log.Close()
t.Run("Allow exact origin with port", func(t *testing.T) {
router := gin.New()
// Mock site config in context
router.Use(func(c *gin.Context) {
c.Set("site_config", loaders.SiteConfig{
Security: loaders.Security{
AllowOrigin: []string{"https://golyn.humanjuan.local:5173"},
},
})
c.Next()
})
router.Use(middlewares.CorsMiddleware())
router.GET("/test", func(c *gin.Context) {
c.Status(http.StatusOK)
})
w := httptest.NewRecorder()
req, _ := http.NewRequest("GET", "/test", nil)
req.Header.Set("Origin", "https://golyn.humanjuan.local:5173")
req.Host = "golyn.humanjuan.local"
router.ServeHTTP(w, req)
if w.Header().Get("Access-Control-Allow-Origin") != "https://golyn.humanjuan.local:5173" {
t.Errorf("Expected allowed origin, got %s", w.Header().Get("Access-Control-Allow-Origin"))
}
})
t.Run("Allow dev origin with different port", func(t *testing.T) {
globals.SetConfig(&loaders.Config{Server: loaders.Server{Dev: true}})
router := gin.New()
router.Use(func(c *gin.Context) {
c.Set("site_config", loaders.SiteConfig{
Security: loaders.Security{
AllowOrigin: []string{"https://golyn.humanjuan.local"},
},
})
c.Next()
})
router.Use(middlewares.CorsMiddleware())
router.GET("/test", func(c *gin.Context) {
c.Status(http.StatusOK)
})
w := httptest.NewRecorder()
req, _ := http.NewRequest("GET", "/test", nil)
req.Header.Set("Origin", "https://golyn.humanjuan.local:5173")
req.Host = "golyn.humanjuan.local"
router.ServeHTTP(w, req)
if w.Header().Get("Access-Control-Allow-Origin") != "https://golyn.humanjuan.local:5173" {
t.Errorf("Expected allowed dev origin, got %s", w.Header().Get("Access-Control-Allow-Origin"))
}
})
t.Run("Block dev origin if scheme doesn't match", func(t *testing.T) {
globals.SetConfig(&loaders.Config{Server: loaders.Server{Dev: true}})
router := gin.New()
router.Use(func(c *gin.Context) {
c.Set("site_config", loaders.SiteConfig{
Security: loaders.Security{
AllowOrigin: []string{"https://golyn.humanjuan.local"},
},
})
c.Next()
})
router.Use(middlewares.CorsMiddleware())
w := httptest.NewRecorder()
req, _ := http.NewRequest("GET", "/test", nil)
req.Header.Set("Origin", "http://golyn.humanjuan.local:5173")
req.Host = "golyn.humanjuan.local"
router.ServeHTTP(w, req)
if w.Header().Get("Access-Control-Allow-Origin") != "" {
t.Errorf("Origin with different scheme should be blocked, but got %s", w.Header().Get("Access-Control-Allow-Origin"))
}
})
}