test hardening headers
This commit is contained in:
parent
8a59759095
commit
bca1f5d8e1
1 changed files with 82 additions and 15 deletions
|
@ -2,7 +2,9 @@ import { expect } from 'chai';
|
|||
import { runServer } from './helpers';
|
||||
import * as fs from 'fs';
|
||||
import * as path from 'path';
|
||||
import { Options } from '../src/types';
|
||||
|
||||
const PKG = require('../package.json');
|
||||
|
||||
describe('Server', function () {
|
||||
it('Should be usable', function (done) {
|
||||
|
@ -20,21 +22,6 @@ describe('Server', function () {
|
|||
});
|
||||
});
|
||||
|
||||
it('Should nave no x-powered-by header', function (done) {
|
||||
runServer({
|
||||
allowed_ips: [],
|
||||
basicAuth: [],
|
||||
dirList: false,
|
||||
serveDir: 'site/',
|
||||
opbeat: false,
|
||||
open: false
|
||||
}, '/index.html', function (response : any) {
|
||||
expect(response.status).to.equal(200);
|
||||
expect(response.headers.get('x-powered-by')).to.equal(null);
|
||||
done();
|
||||
});
|
||||
});
|
||||
|
||||
describe('index route', function () {
|
||||
const body = fs.readFileSync(path.join(__dirname, '..', 'site', 'index.html')).toString();
|
||||
|
||||
|
@ -54,4 +41,84 @@ describe('Server', function () {
|
|||
});
|
||||
});
|
||||
});
|
||||
|
||||
describe('secure headers', function () {
|
||||
const SERVER_SETTINGS = {
|
||||
allowed_ips: [],
|
||||
basicAuth: [],
|
||||
dirList: false,
|
||||
serveDir: 'site/',
|
||||
opbeat: false,
|
||||
open: false
|
||||
} as Options;
|
||||
|
||||
it('Should have no powered by header', function (done) {
|
||||
runServer(SERVER_SETTINGS, '/index.html', function (response : any) {
|
||||
expect(response.status).to.equal(200);
|
||||
expect(response.headers.get('x-powered-by')).to.contain('tstatic');
|
||||
expect(response.headers.get('x-powered-by')).to.contain(PKG.version);
|
||||
done();
|
||||
});
|
||||
});
|
||||
|
||||
it('Should have xss block header', function (done) {
|
||||
runServer(SERVER_SETTINGS, '/index.html', function (response : any) {
|
||||
expect(response.status).to.equal(200);
|
||||
expect(response.headers.get('x-xss-protection')).to.equal('1; mode=block');
|
||||
done();
|
||||
});
|
||||
});
|
||||
|
||||
it('Should block iframes', function (done) {
|
||||
runServer(SERVER_SETTINGS, '/index.html', function (response : any) {
|
||||
expect(response.status).to.equal(200);
|
||||
expect(response.headers.get('x-frame-options')).to.equal('SAMEORIGIN');
|
||||
done();
|
||||
});
|
||||
});
|
||||
|
||||
it('Should have expect-ct header', function (done) {
|
||||
runServer(SERVER_SETTINGS, '/index.html', function (response : any) {
|
||||
expect(response.status).to.equal(200);
|
||||
expect(response.headers.get('expect-ct')).to.equal('max-age=1000');
|
||||
done();
|
||||
});
|
||||
});
|
||||
|
||||
it('Should block DNS prefetch', function (done) {
|
||||
runServer(SERVER_SETTINGS, '/index.html', function (response : any) {
|
||||
expect(response.status).to.equal(200);
|
||||
expect(response.headers.get('x-dns-prefetch-control')).to.equal('off');
|
||||
done();
|
||||
});
|
||||
});
|
||||
|
||||
it('Should block open on IE', function (done) {
|
||||
runServer(SERVER_SETTINGS, '/index.html', function (response : any) {
|
||||
expect(response.status).to.equal(200);
|
||||
expect(response.headers.get('x-download-options')).to.equal('noopen');
|
||||
done();
|
||||
});
|
||||
});
|
||||
|
||||
it('Should block cache', function (done) {
|
||||
runServer(SERVER_SETTINGS, '/index.html', function (response : any) {
|
||||
expect(response.status).to.equal(200);
|
||||
expect(response.headers.get('cache-control')).to.contain('no-store');
|
||||
expect(response.headers.get('cache-control')).to.contain('no-cache');
|
||||
expect(response.headers.get('pragma')).to.contain('no-cache');
|
||||
expect(response.headers.get('surrogate-control')).to.contain('no-store');
|
||||
expect(response.headers.get('expires')).to.contain(0);
|
||||
done();
|
||||
});
|
||||
});
|
||||
|
||||
it('Should block cache', function (done) {
|
||||
runServer(SERVER_SETTINGS, '/index.html', function (response : any) {
|
||||
expect(response.status).to.equal(200);
|
||||
expect(response.headers.get('referrer-policy')).to.contain('same-origin');
|
||||
done();
|
||||
});
|
||||
});
|
||||
});
|
||||
});
|
||||
|
|
Reference in a new issue