|
| 1 | +package middleware |
| 2 | + |
| 3 | +import ( |
| 4 | + "net/http" |
| 5 | + "net/http/httptest" |
| 6 | + "testing" |
| 7 | + "time" |
| 8 | + |
| 9 | + "github.com/go-authgate/authgate/internal/config" |
| 10 | + |
| 11 | + "github.com/gin-gonic/gin" |
| 12 | + "github.com/stretchr/testify/assert" |
| 13 | +) |
| 14 | + |
| 15 | +func setupCORSRouter(cfg *config.Config) *gin.Engine { |
| 16 | + gin.SetMode(gin.TestMode) |
| 17 | + r := gin.New() |
| 18 | + r.Use(CORSMiddleware(cfg)) |
| 19 | + r.GET("/oauth/tokeninfo", func(c *gin.Context) { |
| 20 | + c.String(http.StatusOK, "ok") |
| 21 | + }) |
| 22 | + r.POST("/oauth/token", func(c *gin.Context) { |
| 23 | + c.String(http.StatusOK, "ok") |
| 24 | + }) |
| 25 | + r.OPTIONS("/oauth/token", func(c *gin.Context) { |
| 26 | + c.Status(http.StatusNoContent) |
| 27 | + }) |
| 28 | + return r |
| 29 | +} |
| 30 | + |
| 31 | +func defaultCORSConfig() *config.Config { |
| 32 | + return &config.Config{ |
| 33 | + CORSEnabled: true, |
| 34 | + CORSAllowedOrigins: []string{"http://localhost:3000"}, |
| 35 | + CORSAllowedMethods: []string{"GET", "POST", "PUT", "DELETE", "OPTIONS"}, |
| 36 | + CORSAllowedHeaders: []string{"Origin", "Content-Type", "Authorization"}, |
| 37 | + CORSMaxAge: 12 * time.Hour, |
| 38 | + } |
| 39 | +} |
| 40 | + |
| 41 | +func TestCORS_AllowedOrigin(t *testing.T) { |
| 42 | + r := setupCORSRouter(defaultCORSConfig()) |
| 43 | + |
| 44 | + w := httptest.NewRecorder() |
| 45 | + req, _ := http.NewRequest(http.MethodGet, "/oauth/tokeninfo", nil) |
| 46 | + req.Header.Set("Origin", "http://localhost:3000") |
| 47 | + r.ServeHTTP(w, req) |
| 48 | + |
| 49 | + assert.Equal(t, http.StatusOK, w.Code) |
| 50 | + assert.Equal(t, "http://localhost:3000", w.Header().Get("Access-Control-Allow-Origin")) |
| 51 | + assert.Equal(t, "true", w.Header().Get("Access-Control-Allow-Credentials")) |
| 52 | +} |
| 53 | + |
| 54 | +func TestCORS_DisallowedOrigin(t *testing.T) { |
| 55 | + r := setupCORSRouter(defaultCORSConfig()) |
| 56 | + |
| 57 | + w := httptest.NewRecorder() |
| 58 | + req, _ := http.NewRequest(http.MethodGet, "/oauth/tokeninfo", nil) |
| 59 | + req.Header.Set("Origin", "http://evil.com") |
| 60 | + r.ServeHTTP(w, req) |
| 61 | + |
| 62 | + // gin-contrib/cors returns 403 for disallowed origins |
| 63 | + assert.Equal(t, http.StatusForbidden, w.Code) |
| 64 | + assert.Empty(t, w.Header().Get("Access-Control-Allow-Origin")) |
| 65 | +} |
| 66 | + |
| 67 | +func TestCORS_PreflightRequest(t *testing.T) { |
| 68 | + r := setupCORSRouter(defaultCORSConfig()) |
| 69 | + |
| 70 | + w := httptest.NewRecorder() |
| 71 | + req, _ := http.NewRequest(http.MethodOptions, "/oauth/token", nil) |
| 72 | + req.Header.Set("Origin", "http://localhost:3000") |
| 73 | + req.Header.Set("Access-Control-Request-Method", "POST") |
| 74 | + req.Header.Set("Access-Control-Request-Headers", "Content-Type,Authorization") |
| 75 | + r.ServeHTTP(w, req) |
| 76 | + |
| 77 | + assert.Equal(t, http.StatusNoContent, w.Code) |
| 78 | + assert.Equal(t, "http://localhost:3000", w.Header().Get("Access-Control-Allow-Origin")) |
| 79 | + assert.Contains(t, w.Header().Get("Access-Control-Allow-Methods"), "POST") |
| 80 | + assert.Contains(t, w.Header().Get("Access-Control-Allow-Headers"), "Content-Type") |
| 81 | + assert.Contains(t, w.Header().Get("Access-Control-Allow-Headers"), "Authorization") |
| 82 | + assert.NotEmpty(t, w.Header().Get("Access-Control-Max-Age")) |
| 83 | +} |
| 84 | + |
| 85 | +func TestCORS_PreflightDisallowedOrigin(t *testing.T) { |
| 86 | + r := setupCORSRouter(defaultCORSConfig()) |
| 87 | + |
| 88 | + w := httptest.NewRecorder() |
| 89 | + req, _ := http.NewRequest(http.MethodOptions, "/oauth/token", nil) |
| 90 | + req.Header.Set("Origin", "http://evil.com") |
| 91 | + req.Header.Set("Access-Control-Request-Method", "POST") |
| 92 | + r.ServeHTTP(w, req) |
| 93 | + |
| 94 | + assert.Empty(t, w.Header().Get("Access-Control-Allow-Origin")) |
| 95 | +} |
| 96 | + |
| 97 | +func TestCORS_MultipleOrigins(t *testing.T) { |
| 98 | + cfg := defaultCORSConfig() |
| 99 | + cfg.CORSAllowedOrigins = []string{"http://localhost:3000", "https://app.example.com"} |
| 100 | + r := setupCORSRouter(cfg) |
| 101 | + |
| 102 | + // First origin |
| 103 | + w := httptest.NewRecorder() |
| 104 | + req, _ := http.NewRequest(http.MethodGet, "/oauth/tokeninfo", nil) |
| 105 | + req.Header.Set("Origin", "http://localhost:3000") |
| 106 | + r.ServeHTTP(w, req) |
| 107 | + assert.Equal(t, "http://localhost:3000", w.Header().Get("Access-Control-Allow-Origin")) |
| 108 | + |
| 109 | + // Second origin |
| 110 | + w = httptest.NewRecorder() |
| 111 | + req, _ = http.NewRequest(http.MethodGet, "/oauth/tokeninfo", nil) |
| 112 | + req.Header.Set("Origin", "https://app.example.com") |
| 113 | + r.ServeHTTP(w, req) |
| 114 | + assert.Equal(t, "https://app.example.com", w.Header().Get("Access-Control-Allow-Origin")) |
| 115 | +} |
| 116 | + |
| 117 | +func TestCORS_NoOriginHeader(t *testing.T) { |
| 118 | + r := setupCORSRouter(defaultCORSConfig()) |
| 119 | + |
| 120 | + w := httptest.NewRecorder() |
| 121 | + req, _ := http.NewRequest(http.MethodGet, "/oauth/tokeninfo", nil) |
| 122 | + // No Origin header — same-origin request |
| 123 | + r.ServeHTTP(w, req) |
| 124 | + |
| 125 | + assert.Equal(t, http.StatusOK, w.Code) |
| 126 | + assert.Empty(t, w.Header().Get("Access-Control-Allow-Origin")) |
| 127 | +} |
| 128 | + |
| 129 | +func TestCORS_ExposeHeaders(t *testing.T) { |
| 130 | + r := setupCORSRouter(defaultCORSConfig()) |
| 131 | + |
| 132 | + w := httptest.NewRecorder() |
| 133 | + req, _ := http.NewRequest(http.MethodGet, "/oauth/tokeninfo", nil) |
| 134 | + req.Header.Set("Origin", "http://localhost:3000") |
| 135 | + r.ServeHTTP(w, req) |
| 136 | + |
| 137 | + exposed := w.Header().Get("Access-Control-Expose-Headers") |
| 138 | + assert.Contains(t, exposed, "Content-Length") |
| 139 | + assert.Contains(t, exposed, "Content-Type") |
| 140 | +} |
| 141 | + |
| 142 | +func TestCORS_POSTWithOrigin(t *testing.T) { |
| 143 | + r := setupCORSRouter(defaultCORSConfig()) |
| 144 | + |
| 145 | + w := httptest.NewRecorder() |
| 146 | + req, _ := http.NewRequest(http.MethodPost, "/oauth/token", nil) |
| 147 | + req.Header.Set("Origin", "http://localhost:3000") |
| 148 | + req.Header.Set("Content-Type", "application/x-www-form-urlencoded") |
| 149 | + r.ServeHTTP(w, req) |
| 150 | + |
| 151 | + assert.Equal(t, http.StatusOK, w.Code) |
| 152 | + assert.Equal(t, "http://localhost:3000", w.Header().Get("Access-Control-Allow-Origin")) |
| 153 | +} |
| 154 | + |
| 155 | +func TestNewCORSConfig(t *testing.T) { |
| 156 | + cfg := NewCORSConfig( |
| 157 | + []string{"http://localhost:3000"}, |
| 158 | + []string{"GET", "POST"}, |
| 159 | + []string{"Authorization"}, |
| 160 | + 1*time.Hour, |
| 161 | + ) |
| 162 | + |
| 163 | + assert.Equal(t, []string{"http://localhost:3000"}, cfg.AllowOrigins) |
| 164 | + assert.Equal(t, []string{"GET", "POST"}, cfg.AllowMethods) |
| 165 | + assert.Equal(t, []string{"Authorization"}, cfg.AllowHeaders) |
| 166 | + assert.Equal(t, 1*time.Hour, cfg.MaxAge) |
| 167 | + assert.True(t, cfg.AllowCredentials) |
| 168 | +} |
0 commit comments