Rogeeandrogee
f719529d66
* fix(security): harden auth and credential handling (HH-444) * fix(security): address HH-444 review blockers * fix(security): close remaining HH-444 review blockers --------- Co-authored-by: Rogee <rogee@ipao.vip>
33 lines
1.1 KiB
JavaScript
33 lines
1.1 KiB
JavaScript
import Cookies from 'js-cookie';
|
|
import { clearBrowserSessionCookies, setAuthCredentials } from './api';
|
|
|
|
describe('browser auth storage', () => {
|
|
it('never persists response auth headers in JavaScript-readable storage', () => {
|
|
const cookie = vi.spyOn(Cookies, 'set');
|
|
const storage = vi.spyOn(Storage.prototype, 'setItem');
|
|
|
|
setAuthCredentials({
|
|
data: { data: { id: 1 } },
|
|
headers: { 'access-token': 'xss-readable-token', client: 'browser' },
|
|
});
|
|
|
|
expect(cookie).not.toHaveBeenCalled();
|
|
expect(storage).not.toHaveBeenCalledWith(
|
|
expect.any(String),
|
|
expect.stringContaining('xss-readable-token')
|
|
);
|
|
});
|
|
|
|
it('removes legacy auth storage during logout', () => {
|
|
const removeCookie = vi.spyOn(Cookies, 'remove');
|
|
const removeStorage = vi.spyOn(Storage.prototype, 'removeItem');
|
|
|
|
clearBrowserSessionCookies();
|
|
|
|
expect(removeCookie).toHaveBeenCalledWith('cw_d_session_info');
|
|
expect(removeCookie).toHaveBeenCalledWith('cw_d_session_state');
|
|
expect(removeStorage).toHaveBeenCalledWith('access-token');
|
|
expect(removeStorage).toHaveBeenCalledWith('client');
|
|
});
|
|
});
|