37 lines
1.6 KiB
TypeScript
37 lines
1.6 KiB
TypeScript
import { expect, test } from 'bun:test';
|
|
import type { RequestEvent } from '@sveltejs/kit';
|
|
import { handle } from '../src/hooks.server';
|
|
import { assertSameOrigin } from '../src/lib/server/security';
|
|
|
|
async function headers(path: string) {
|
|
const response = await handle({
|
|
event: { url: new URL(path, 'https://app.example') } as RequestEvent,
|
|
resolve: async () => new Response('ok'),
|
|
});
|
|
return response.headers;
|
|
}
|
|
|
|
test('app pages preserve native form Origin without sharing cross-origin referrers', async () => {
|
|
for (const path of ['/', '/characters', '/assets']) {
|
|
const result = await headers(path);
|
|
expect(result.get('referrer-policy')).toBe('same-origin');
|
|
expect(result.get('cache-control')).toBe('no-store');
|
|
expect(result.get('x-content-type-options')).toBe('nosniff');
|
|
}
|
|
});
|
|
|
|
test('OAuth initiation and callback URLs remain no-referrer', async () => {
|
|
for (const path of ['/auth/eve', '/auth/eve/callback?code=test-only&state=test-only', '/auth/logout']) {
|
|
expect((await headers(path)).get('referrer-policy')).toBe('no-referrer');
|
|
}
|
|
});
|
|
|
|
test('origin protection still rejects null, absent, and foreign origins', () => {
|
|
const expected = 'https://app.example';
|
|
for (const origin of [undefined, 'null', 'https://foreign.example']) {
|
|
const request = new Request(`${expected}/auth/eve`, { method: 'POST', headers: origin ? { origin } : {} });
|
|
expect(() => assertSameOrigin(request, expected)).toThrow();
|
|
}
|
|
expect(() => assertSameOrigin(new Request(`${expected}/auth/eve`, { method: 'POST', headers: { origin: expected } }), expected)).not.toThrow();
|
|
});
|