44 lines
2.1 KiB
TypeScript
44 lines
2.1 KiB
TypeScript
import { expect, test } from "bun:test";
|
|
import { withSecurityHeaders } from "../src/headers.ts";
|
|
const request = new Request("https://app.example.test/");
|
|
const policy =
|
|
"default-src 'none'; style-src 'unsafe-inline'; frame-ancestors https://customer.example.test; sandbox";
|
|
test("route CSP does not override the default without explicit application opt-in", () => {
|
|
const response = withSecurityHeaders(
|
|
request,
|
|
new Response("static", { headers: { "content-security-policy": policy } }),
|
|
"production",
|
|
);
|
|
expect(response.headers.get("content-security-policy")).toContain("default-src 'self'");
|
|
expect(response.headers.get("x-frame-options")).toBe("SAMEORIGIN");
|
|
});
|
|
test("trusted static routes retain strict CSP and explicit cross-origin framing when enabled", () => {
|
|
const response = withSecurityHeaders(
|
|
request,
|
|
new Response("static", { headers: { "content-security-policy": policy } }),
|
|
"production",
|
|
{ routeContentSecurityPolicy: true },
|
|
);
|
|
expect(response.headers.get("content-security-policy")).toBe(policy);
|
|
expect(response.headers.has("x-frame-options")).toBe(false);
|
|
expect(response.headers.get("x-content-type-options")).toBe("nosniff");
|
|
expect(response.headers.get("strict-transport-security")).toContain("max-age=");
|
|
});
|
|
test("ordinary routes keep defaults and a route without frame-ancestors keeps frame restrictions", () => {
|
|
const ordinary = withSecurityHeaders(request, new Response("app"), "production", {
|
|
routeContentSecurityPolicy: true,
|
|
});
|
|
expect(ordinary.headers.get("content-security-policy")).toContain("default-src 'self'");
|
|
expect(ordinary.headers.get("x-frame-options")).toBe("SAMEORIGIN");
|
|
const staticResponse = withSecurityHeaders(
|
|
request,
|
|
new Response("static", {
|
|
headers: { "content-security-policy": "default-src 'none'; sandbox" },
|
|
}),
|
|
"production",
|
|
{ routeContentSecurityPolicy: true },
|
|
);
|
|
expect(staticResponse.headers.get("content-security-policy")).toBe("default-src 'none'; sandbox");
|
|
expect(staticResponse.headers.get("x-frame-options")).toBe("SAMEORIGIN");
|
|
});
|