11 lines
994 B
TypeScript
11 lines
994 B
TypeScript
import {expect,test} from "bun:test";
|
|
import {withSecurityHeaders} from "../src/headers.ts";
|
|
test("explicit response resource policies survive defaults while configured application policy wins",()=>{
|
|
const req=new Request("https://example.com/image.png");
|
|
const image=()=>new Response("image",{headers:{"Cross-Origin-Resource-Policy":"cross-origin","Content-Type":"image/png"}});
|
|
expect(withSecurityHeaders(req,image(),"production").headers.get("Cross-Origin-Resource-Policy")).toBe("cross-origin");
|
|
expect(withSecurityHeaders(req,new Response("private"),"production").headers.get("Cross-Origin-Resource-Policy")).toBe("same-origin");
|
|
expect(withSecurityHeaders(req,image(),"production",{crossOriginResourcePolicy:"same-origin"}).headers.get("Cross-Origin-Resource-Policy")).toBe("same-origin");
|
|
expect(withSecurityHeaders(req,new Response("x",{headers:{"Cross-Origin-Resource-Policy":"invalid"}}),"production").headers.get("Cross-Origin-Resource-Policy")).toBe("same-origin");
|
|
});
|