姚章浩
34 lines
1.1 KiB
Go
34 lines
1.1 KiB
Go
package httpapi
|
|
|
|
import (
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
func TestQAOrganizationSameOriginThroughReverseProxy(t *testing.T) {
|
|
auth := newFakeAuthStore()
|
|
auth.sessions["org-proxy-admin"] = "usr-boss"
|
|
spy := &orgSpy{}
|
|
handler, err := NewHandler(Config{Store: &fakeJobStore{}, QAOrg: spy, Auth: &AuthConfig{Store: auth}})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
for _, tc := range []struct {
|
|
site string
|
|
status int
|
|
}{{"same-origin", 200}, {"cross-site", 403}, {"same-site", 403}} {
|
|
req := httptest.NewRequest("PUT", "http://internal-api:8080/api/v1/qa-ops/organization/regions", strings.NewReader(`{"directory_id":"d","base_revision":"","rules":[]}`))
|
|
req.AddCookie(&http.Cookie{Name: sessionCookieName, Value: "org-proxy-admin"})
|
|
req.Header.Set("X-Governance-Action", "qa-organization")
|
|
req.Header.Set("Origin", "http://frontend:8088")
|
|
req.Header.Set("Sec-Fetch-Site", tc.site)
|
|
res := httptest.NewRecorder()
|
|
handler.ServeHTTP(res, req)
|
|
if res.Code != tc.status {
|
|
t.Fatalf("proxy fetch site %s got %d want %d", tc.site, res.Code, tc.status)
|
|
}
|
|
}
|
|
}
|