João Henrique
b541f502ba
- Adicionado estrutura completa do projeto - Configurado MCP server para Premiere Pro - Adicionado documentação e skills - Configurado Gitignore para o projeto
41 lines
1.7 KiB
TypeScript
Executable File
41 lines
1.7 KiB
TypeScript
Executable File
import { describe, expect, it, vi } from "vitest";
|
|
import { applyHttpSecurityHeaders, buildContentSecurityPolicy, HTTP_SECURITY_HEADERS } from "../src/http-security.js";
|
|
|
|
describe("HTTP security headers", () => {
|
|
it("sets a restrictive baseline on every response", () => {
|
|
const setHeader = vi.fn();
|
|
applyHttpSecurityHeaders({ setHeader } as never);
|
|
|
|
expect(setHeader).toHaveBeenCalledWith("X-Content-Type-Options", "nosniff");
|
|
expect(setHeader).toHaveBeenCalledWith("X-Frame-Options", "DENY");
|
|
expect(setHeader).toHaveBeenCalledWith(
|
|
"Strict-Transport-Security",
|
|
"max-age=31536000; includeSubDomains",
|
|
);
|
|
expect(setHeader).toHaveBeenCalledWith(
|
|
"Permissions-Policy",
|
|
"camera=(), microphone=(), geolocation=()",
|
|
);
|
|
});
|
|
|
|
it("blocks framing, plugins, and unlisted network destinations", () => {
|
|
const policy = HTTP_SECURITY_HEADERS["Content-Security-Policy"];
|
|
expect(policy).toContain("frame-ancestors 'none'");
|
|
expect(policy).toContain("object-src 'none'");
|
|
expect(policy).toContain("connect-src 'self'");
|
|
expect(policy).toContain("https://www.google.com");
|
|
expect(policy).not.toContain("connect-src *");
|
|
expect(policy).not.toContain("script-src 'self' 'unsafe-inline'");
|
|
});
|
|
|
|
it("uses a per-response nonce instead of allowing inline scripts", () => {
|
|
const setHeader = vi.fn();
|
|
applyHttpSecurityHeaders({ setHeader } as never, { scriptNonce: "nonce-value" });
|
|
expect(setHeader).toHaveBeenCalledWith(
|
|
"Content-Security-Policy",
|
|
expect.stringContaining("script-src 'self' 'nonce-nonce-value' https://www.googletagmanager.com"),
|
|
);
|
|
expect(buildContentSecurityPolicy()).not.toContain("'unsafe-inline' https://www.googletagmanager.com");
|
|
});
|
|
});
|