30 lines
1.1 KiB
TypeScript
30 lines
1.1 KiB
TypeScript
import { expect, test } from "bun:test";
|
|
import { withSecurityHeaders } from "../src/headers.ts";
|
|
test("explicit response resource policies survive defaults while configured application policy wins", () => {
|
|
const req = new Request("https://example.com/image.png");
|
|
const image = () =>
|
|
new Response("image", {
|
|
headers: { "Cross-Origin-Resource-Policy": "cross-origin", "Content-Type": "image/png" },
|
|
});
|
|
expect(
|
|
withSecurityHeaders(req, image(), "production").headers.get("Cross-Origin-Resource-Policy"),
|
|
).toBe("cross-origin");
|
|
expect(
|
|
withSecurityHeaders(req, new Response("private"), "production").headers.get(
|
|
"Cross-Origin-Resource-Policy",
|
|
),
|
|
).toBe("same-origin");
|
|
expect(
|
|
withSecurityHeaders(req, image(), "production", {
|
|
crossOriginResourcePolicy: "same-origin",
|
|
}).headers.get("Cross-Origin-Resource-Policy"),
|
|
).toBe("same-origin");
|
|
expect(
|
|
withSecurityHeaders(
|
|
req,
|
|
new Response("x", { headers: { "Cross-Origin-Resource-Policy": "invalid" } }),
|
|
"production",
|
|
).headers.get("Cross-Origin-Resource-Policy"),
|
|
).toBe("same-origin");
|
|
});
|