22 lines
832 B
TypeScript
22 lines
832 B
TypeScript
import { expect, test } from "bun:test";
|
|
import { withSecurityHeaders } from "../src/headers.ts";
|
|
test("default framing permits self but not cross-origin ancestors", () => {
|
|
const headers = withSecurityHeaders(
|
|
new Request("https://app.test"),
|
|
new Response("ok"),
|
|
"production",
|
|
).headers;
|
|
expect(headers.get("x-frame-options")).toBe("SAMEORIGIN");
|
|
expect(headers.get("content-security-policy")).toContain("frame-ancestors 'self'");
|
|
});
|
|
test("explicit DENY keeps both framing policies restrictive", () => {
|
|
const headers = withSecurityHeaders(
|
|
new Request("https://app.test"),
|
|
new Response("ok"),
|
|
"production",
|
|
{ frameOptions: "DENY" },
|
|
).headers;
|
|
expect(headers.get("x-frame-options")).toBe("DENY");
|
|
expect(headers.get("content-security-policy")).toContain("frame-ancestors 'none'");
|
|
});
|