Skip to content

Commit 1730742

Browse files
Krishanx92Krishanx92
authored
Merge pull request #710 from RakhithaRR/cors-it
Add integration tests for CORS policy
2 parents a2f2b99 + 80f8723 commit 1730742

File tree

3 files changed

+129
-0
lines changed

3 files changed

+129
-0
lines changed

‎gateway/it/features/cors.feature‎

Lines changed: 122 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,122 @@
1+
# --------------------------------------------------------------------
2+
# Copyright (c) 2026, WSO2 LLC. (https://www.wso2.com).
3+
#
4+
# WSO2 LLC. licenses this file to you under the Apache License,
5+
# Version 2.0 (the "License"); you may not use this file except
6+
# in compliance with the License.
7+
# You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing,
12+
# software distributed under the License is distributed on an
13+
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
14+
# KIND, either express or implied. See the License for the
15+
# specific language governing permissions and limitations
16+
# under the License.
17+
# --------------------------------------------------------------------
18+
19+
@cors
20+
Feature: CORS Policy
21+
As an API developer
22+
I want to configure CORS policies on my API
23+
So that cross-origin requests are correctly allowed and preflighted
24+
25+
Background:
26+
Given the gateway services are running
27+
28+
Scenario: Preflight request allows configured origin, methods, and headers
29+
Given I authenticate using basic auth as "admin"
30+
When I deploy this API configuration:
31+
"""
32+
apiVersion: gateway.api-platform.wso2.com/v1alpha1
33+
kind: RestApi
34+
metadata:
35+
name: cors-preflight-api
36+
spec:
37+
displayName: CORS Preflight API
38+
version: v1.0
39+
context: /cors-preflight/$version
40+
upstream:
41+
main:
42+
url: http://sample-backend:9080/api/v1
43+
policies:
44+
- name: cors
45+
version: v0.1.0
46+
params:
47+
allowedOrigins:
48+
- "http://example.com"
49+
- '^https://[^.]+\.example\.com$'
50+
- "http://localhost:5000"
51+
allowedMethods:
52+
- "GET"
53+
- "POST"
54+
allowedHeaders:
55+
- "Content-Type"
56+
exposedHeaders:
57+
- X-Content-Type-Options
58+
operations:
59+
- method: GET
60+
path: /{country_code}/{city}
61+
- method: GET
62+
path: /alerts/active
63+
- method: OPTIONS
64+
path: /{country_code}/{city}
65+
"""
66+
Then the response should be successful
67+
And I wait for the endpoint "http://localhost:8080/cors-preflight/v1.0/us/seattle" to be ready
68+
69+
When I set header "Origin" to "http://example.com"
70+
And I set header "Access-Control-Request-Method" to "POST"
71+
And I set header "Access-Control-Request-Headers" to "Content-Type"
72+
And I send an OPTIONS request to "http://localhost:8080/cors-preflight/v1.0/us/seattle"
73+
Then the response status code should be 204
74+
And the response header "Access-Control-Allow-Origin" should be "http://example.com"
75+
And the response header "Access-Control-Allow-Methods" should contain "GET"
76+
And the response header "Access-Control-Allow-Methods" should contain "POST"
77+
And the response header "Access-Control-Allow-Headers" should contain "Content-Type"
78+
79+
Scenario: Preflight request allows configured origin based on regex
80+
When I set header "Origin" to "https://app.example.com"
81+
And I set header "Access-Control-Request-Method" to "GET"
82+
And I set header "Access-Control-Request-Headers" to "Content-Type"
83+
And I send an OPTIONS request to "http://localhost:8080/cors-preflight/v1.0/us/seattle"
84+
Then the response status code should be 204
85+
And the response header "Access-Control-Allow-Origin" should be "https://app.example.com"
86+
And the response header "Access-Control-Allow-Methods" should contain "GET"
87+
And the response header "Access-Control-Allow-Methods" should contain "POST"
88+
And the response header "Access-Control-Allow-Headers" should contain "Content-Type"
89+
90+
Scenario: Preflight request fails for disallowed origin
91+
When I set header "Origin" to "http://evil.com"
92+
And I set header "Access-Control-Request-Method" to "GET"
93+
And I set header "Access-Control-Request-Headers" to "Content-Type"
94+
And I send an OPTIONS request to "http://localhost:8080/cors-preflight/v1.0/us/seattle"
95+
Then the response status code should be 204
96+
And the response header "Access-Control-Allow-Origin" should not exist
97+
And the response header "Access-Control-Allow-Methods" should not exist
98+
And the response header "Access-Control-Allow-Headers" should not exist
99+
100+
Scenario: Preflight request fails for disallowed method
101+
When I set header "Origin" to "http://example.com"
102+
And I set header "Access-Control-Request-Method" to "PUT"
103+
And I set header "Access-Control-Request-Headers" to "Content-Type"
104+
And I send an OPTIONS request to "http://localhost:8080/cors-preflight/v1.0/us/seattle"
105+
Then the response status code should be 204
106+
And the response header "Access-Control-Allow-Origin" should not exist
107+
And the response header "Access-Control-Allow-Methods" should not exist
108+
And the response header "Access-Control-Allow-Headers" should not exist
109+
110+
Scenario: Preflight request fails for disallowed header
111+
When I set header "Origin" to "http://example.com"
112+
And I set header "Access-Control-Request-Method" to "GET"
113+
And I set header "Access-Control-Request-Headers" to "Authorization"
114+
And I send an OPTIONS request to "http://localhost:8080/cors-preflight/v1.0/us/seattle"
115+
Then the response status code should be 204
116+
And the response header "Access-Control-Allow-Origin" should not exist
117+
And the response header "Access-Control-Allow-Methods" should not exist
118+
And the response header "Access-Control-Allow-Headers" should not exist
119+
120+
Given I authenticate using basic auth as "admin"
121+
When I delete the API "cors-preflight-api"
122+
Then the response should be successful

‎gateway/it/steps/http_steps.go‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,7 @@ func (h *HTTPSteps) Register(ctx *godog.ScenarioContext) {
6767
ctx.Step(`^I send a PUT request to \"([^\"]*)\" with body:$`, h.ISendPUTRequestWithBody)
6868
ctx.Step(`^I send a DELETE request to \"([^\"]*)\"$`, h.ISendDELETERequest)
6969
ctx.Step(`^I send a PATCH request to \"([^\"]*)\" with body:$`, h.ISendPATCHRequestWithBody)
70+
ctx.Step(`^I send an OPTIONS request to \"([^\"]*)\"$`, h.ISendOPTIONSRequest)
7071
ctx.Step(`^I send (\d+) GET requests to \"([^\"]*)\"$`, h.ISendManyGETRequests)
7172
ctx.Step(`^I send a GET request to \"([^\"]*)\" with header \"([^\"]*)\" value \"([^\"]*)\"$`, h.iSendGETRequestWithHeader)
7273
ctx.Step(`^I send (\d+) GET requests to \"([^\"]*)\" with header \"([^\"]*)\" value \"([^\"]*)\"$`, h.iSendManyGETRequestsWithHeader)
@@ -190,6 +191,11 @@ func (h *HTTPSteps) ISendPATCHRequestWithBody(url string, body *godog.DocString)
190191
return h.sendRequest(http.MethodPatch, url, []byte(body.Content))
191192
}
192193

194+
// ISendOPTIONSRequest sends an OPTIONS request
195+
func (h *HTTPSteps) ISendOPTIONSRequest(url string) error {
196+
return h.sendRequest(http.MethodOptions, url, nil)
197+
}
198+
193199
// iSendManyGETRequests sends multiple GET requests
194200
func (h *HTTPSteps) ISendManyGETRequests(count int, url string) error {
195201
log.Printf("DEBUG: Sending %d GET requests to %s", count, url)

‎gateway/it/suite_test.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -79,6 +79,7 @@ func TestFeatures(t *testing.T) {
7979
"features/ratelimit.feature",
8080
"features/basic-ratelimit.feature",
8181
"features/jwt-auth.feature",
82+
"features/cors.feature",
8283
},
8384
TestingT: t,
8485
},

0 commit comments

Comments
 (0)