Nuxt/test/basic.ssr.csp.test.js

117 lines
3.3 KiB
JavaScript
Raw Normal View History

2018-02-01 13:31:02 +00:00
import rp from 'request-promise-native'
2018-03-18 23:41:14 +00:00
import { Nuxt } from '..'
import { loadFixture, getPort } from './utils'
2018-03-16 19:52:17 +00:00
2018-03-18 23:41:14 +00:00
let port
2018-02-01 13:31:02 +00:00
const url = route => 'http://localhost:' + port + route
2018-03-18 19:31:32 +00:00
const startCSPTestServer = async (csp) => {
2018-03-18 23:41:14 +00:00
const options = loadFixture('basic', { render: { csp } })
const nuxt = new Nuxt(options)
port = await getPort()
2018-03-18 19:31:32 +00:00
await nuxt.listen(port, '0.0.0.0')
2018-02-01 13:31:02 +00:00
return nuxt
}
2018-03-18 19:31:32 +00:00
describe('basic ssr csp', () => {
test(
'Not contain Content-Security-Policy header, when csp.enabled is not set',
async () => {
const nuxt = await startCSPTestServer({})
const { headers } = await rp(url('/stateless'), {
resolveWithFullResponse: true
})
2018-02-01 13:31:02 +00:00
2018-03-18 19:31:32 +00:00
expect(headers['content-security-policy']).toBe(undefined)
2018-02-01 13:31:02 +00:00
2018-03-18 19:31:32 +00:00
await nuxt.close()
}
)
2018-02-01 13:31:02 +00:00
2018-03-18 19:31:32 +00:00
test(
'Contain Content-Security-Policy header, when csp.enabled is only set',
async () => {
const cspOption = {
enabled: true
}
2018-02-01 13:31:02 +00:00
2018-03-18 19:31:32 +00:00
const nuxt = await startCSPTestServer(cspOption)
const { headers } = await rp(url('/stateless'), {
resolveWithFullResponse: true
})
2018-02-01 13:31:02 +00:00
2018-03-18 19:31:32 +00:00
expect(headers['content-security-policy']).toMatch(/^script-src 'self' 'sha256-.*'$/)
2018-02-01 13:31:02 +00:00
2018-03-18 19:31:32 +00:00
await nuxt.close()
}
)
test(
'Contain Content-Security-Policy header, when csp.allowedSources set',
async () => {
const cspOption = {
enabled: true,
allowedSources: ['https://example.com', 'https://example.io']
}
2018-02-01 13:31:02 +00:00
2018-03-18 19:31:32 +00:00
const nuxt = await startCSPTestServer(cspOption)
const { headers } = await rp(url('/stateless'), {
resolveWithFullResponse: true
})
2018-02-01 13:31:02 +00:00
2018-03-18 19:31:32 +00:00
expect(headers['content-security-policy']).toMatch(/^script-src 'self' 'sha256-.*'/)
expect(headers['content-security-policy'].includes('https://example.com')).toBe(true)
expect(headers['content-security-policy'].includes('https://example.io')).toBe(true)
2018-02-01 13:31:02 +00:00
2018-03-18 19:31:32 +00:00
await nuxt.close()
2018-02-01 13:31:02 +00:00
}
2018-03-18 19:31:32 +00:00
)
test(
'Contain Content-Security-Policy header, when csp.policies set',
async () => {
const cspOption = {
enabled: true,
policies: {
'default-src': [`'none'`],
'script-src': ['https://example.com', 'https://example.io']
}
}
2018-02-01 13:31:02 +00:00
2018-03-18 19:31:32 +00:00
const nuxt = await startCSPTestServer(cspOption)
const { headers } = await rp(url('/stateless'), {
resolveWithFullResponse: true
})
2018-02-01 13:31:02 +00:00
2018-03-18 19:31:32 +00:00
expect(headers['content-security-policy']).toMatch(/default-src 'none'/)
expect(headers['content-security-policy']).toMatch(/script-src 'self' 'sha256-.*'/)
expect(headers['content-security-policy'].includes('https://example.com')).toBe(true)
expect(headers['content-security-policy'].includes('https://example.io')).toBe(true)
2018-02-02 02:51:16 +00:00
2018-03-18 19:31:32 +00:00
await nuxt.close()
2018-02-02 02:51:16 +00:00
}
2018-03-18 19:31:32 +00:00
)
test(
'Contain Content-Security-Policy header, when csp.policies.script-src is not set',
async () => {
const cspOption = {
enabled: true,
policies: {
'default-src': [`'none'`]
}
}
2018-02-02 02:51:16 +00:00
2018-03-18 19:31:32 +00:00
const nuxt = await startCSPTestServer(cspOption)
const { headers } = await rp(url('/stateless'), {
resolveWithFullResponse: true
})
2018-02-02 02:51:16 +00:00
2018-03-18 19:31:32 +00:00
expect(headers['content-security-policy']).toMatch(/default-src 'none'/)
expect(headers['content-security-policy']).toMatch(/script-src 'self' 'sha256-.*'/)
2018-02-02 02:51:16 +00:00
2018-03-18 19:31:32 +00:00
await nuxt.close()
}
)
2018-02-02 02:51:16 +00:00
})