63 lines
1.8 KiB
Go
63 lines
1.8 KiB
Go
package middleware
|
|
|
|
import (
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"testing"
|
|
|
|
"github.com/gin-gonic/gin"
|
|
"github.com/stretchr/testify/assert"
|
|
)
|
|
|
|
func TestSecurityHeaders_Default(t *testing.T) {
|
|
gin.SetMode(gin.TestMode)
|
|
r := gin.New()
|
|
r.Use(SecurityHeaders(DefaultSecurityHeadersConfig()))
|
|
r.GET("/test", func(c *gin.Context) {
|
|
c.JSON(200, gin.H{"ok": true})
|
|
})
|
|
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodGet, "/test", nil)
|
|
r.ServeHTTP(w, req)
|
|
assert.Equal(t, 200, w.Code)
|
|
assert.Equal(t, "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self'; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'", w.Header().Get("Content-Security-Policy"))
|
|
assert.Contains(t, w.Header().Get("Content-Security-Policy"), "script-src 'self'")
|
|
assert.NotContains(t, w.Header().Get("Content-Security-Policy"), "script-src 'self' 'unsafe-inline'")
|
|
}
|
|
|
|
func TestSecurityHeaders_WithHSTS(t *testing.T) {
|
|
gin.SetMode(gin.TestMode)
|
|
r := gin.New()
|
|
r.Use(SecurityHeaders(SecurityHeadersConfig{
|
|
HSTSMaxAge: 31536000,
|
|
HSTSIncludeSubDomains: true,
|
|
HSTSPreload: true,
|
|
}))
|
|
r.GET("/test", func(c *gin.Context) {
|
|
c.JSON(200, gin.H{"ok": true})
|
|
})
|
|
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodGet, "/test", nil)
|
|
r.ServeHTTP(w, req)
|
|
assert.Equal(t, 200, w.Code)
|
|
}
|
|
|
|
func TestSecurityHeaders_WithCSP(t *testing.T) {
|
|
gin.SetMode(gin.TestMode)
|
|
r := gin.New()
|
|
r.Use(SecurityHeaders(SecurityHeadersConfig{
|
|
CSPDirectives: "default-src 'self'",
|
|
ReferrerPolicy: "strict-origin-when-cross-origin",
|
|
}))
|
|
r.GET("/test", func(c *gin.Context) {
|
|
c.JSON(200, gin.H{"ok": true})
|
|
})
|
|
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodGet, "/test", nil)
|
|
r.ServeHTTP(w, req)
|
|
assert.Equal(t, 200, w.Code)
|
|
}
|