gofakes3/cors_test.go at master · SiaFoundation/gofakes3 · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
package gofakes3

import (
	"net/http"
	"net/http/httptest"
	"testing"
)

func TestWrapInsecureCORSOptionsRequest(t *testing.T) {
	h := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		w.WriteHeader(http.StatusOK)
	})
	corsHandler := wrapInsecureCORS(h)

	req := httptest.NewRequest("OPTIONS", "/", nil)
	req.Header.Set("Origin", "foo")
	req.Header.Set("Access-Control-Request-Method", "GET")
	resp := httptest.NewRecorder()
	corsHandler.ServeHTTP(resp, req)

	if resp.Code != http.StatusOK {
		t.Errorf("Expected status OK; got %v", resp.Code)
	}

	headers := resp.Header()
	if headers.Get("Access-Control-Allow-Origin") != "*" {
		t.Errorf("Expected Access-Control-Allow-Origin: *; got %v", headers.Get("Access-Control-Allow-Origin"))
	}
	if headers.Get("Access-Control-Allow-Methods") != "*" {
		t.Errorf("Expected Access-Control-Allow-Methods: *; got %v", headers.Get("Access-Control-Allow-Methods"))
	}
	if headers.Get("Access-Control-Allow-Headers") != "*" {
		t.Errorf("Expected Access-Control-Allow-Headers: *; got %v", headers.Get("Access-Control-Allow-Headers"))
	}
	if headers.Get("Access-Control-Expose-Headers") != "*" {
		t.Errorf("Expected Access-Control-Expose-Headers: *; got %v", headers.Get("Access-Control-Expose-Headers"))
	}
}

func TestWrapInsecureCORSGetRequest(t *testing.T) {
	h := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		w.WriteHeader(http.StatusOK)
	})
	corsHandler := wrapInsecureCORS(h)

	req := httptest.NewRequest("GET", "/", nil)
	resp := httptest.NewRecorder()
	corsHandler.ServeHTTP(resp, req)

	if resp.Code != http.StatusOK {
		t.Errorf("Expected status OK; got %v", resp.Code)
	}

	headers := resp.Header()
	if _, ok := headers["Access-Control-Allow-Origin"]; ok {
		t.Errorf("expected no Access-Control-Allow-Origin header")
	}
	if _, ok := headers["Access-Control-Allow-Methods"]; ok {
		t.Errorf("expected no Access-Control-Allow-Methods header")
	}
	if _, ok := headers["Access-Control-Allow-Headers"]; ok {
		t.Errorf("expected no Access-Control-Allow-Headers header")
	}
	if _, ok := headers["Access-Control-Expose-Headers"]; ok {
		t.Errorf("expected no Access-Control-Expose-Headers header")
	}
}