36 lines
1.1 KiB
Go
36 lines
1.1 KiB
Go
package webui
|
|
|
|
import (
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"testing"
|
|
)
|
|
|
|
// TestSecurityHeadersSetOnEveryResponse confirms the hardening headers are present
|
|
// regardless of which underlying handler produced the response — admin, webmail, or
|
|
// anything else, since main.go wraps the whole app's handler once with this rather
|
|
// than per-route.
|
|
func TestSecurityHeadersSetOnEveryResponse(t *testing.T) {
|
|
inner := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { w.WriteHeader(http.StatusOK) })
|
|
handler := SecurityHeaders(inner)
|
|
|
|
req := httptest.NewRequest(http.MethodGet, "/anything", nil)
|
|
rec := httptest.NewRecorder()
|
|
handler.ServeHTTP(rec, req)
|
|
|
|
cases := map[string]string{
|
|
"X-Content-Type-Options": "nosniff",
|
|
"X-Frame-Options": "SAMEORIGIN",
|
|
"Referrer-Policy": "same-origin",
|
|
"Content-Security-Policy": contentSecurityPolicy,
|
|
}
|
|
for header, want := range cases {
|
|
if got := rec.Header().Get(header); got != want {
|
|
t.Errorf("header %s = %q, want %q", header, got, want)
|
|
}
|
|
}
|
|
if rec.Header().Get("Permissions-Policy") == "" {
|
|
t.Error("expected a Permissions-Policy header")
|
|
}
|
|
}
|