(t *testing.T)
| 31 | } |
| 32 | |
| 33 | func TestIsValidOrigin(t *testing.T) { |
| 34 | t.Run("wildcard allows everything", func(t *testing.T) { |
| 35 | assert.True(t, IsValidOrigin("https://anything.com", []string{"*"})) |
| 36 | assert.True(t, IsValidOrigin("http://localhost:9999", []string{"*"})) |
| 37 | }) |
| 38 | |
| 39 | t.Run("empty config defaults to wildcard", func(t *testing.T) { |
| 40 | assert.True(t, IsValidOrigin("https://anything.com", []string{})) |
| 41 | assert.True(t, IsValidOrigin("https://anything.com", nil)) |
| 42 | }) |
| 43 | |
| 44 | // --- Exact domain matching --- |
| 45 | |
| 46 | t.Run("exact domain without port", func(t *testing.T) { |
| 47 | allowed := []string{"https://example.com"} |
| 48 | assert.True(t, IsValidOrigin("https://example.com", allowed)) |
| 49 | assert.True(t, IsValidOrigin("https://example.com/callback", allowed)) |
| 50 | assert.True(t, IsValidOrigin("http://example.com", allowed)) |
| 51 | assert.False(t, IsValidOrigin("https://evil.com", allowed)) |
| 52 | assert.False(t, IsValidOrigin("https://sub.example.com", allowed)) |
| 53 | }) |
| 54 | |
| 55 | t.Run("exact domain with standard port is equivalent to without", func(t *testing.T) { |
| 56 | allowed := []string{"https://example.com:443"} |
| 57 | assert.True(t, IsValidOrigin("https://example.com", allowed)) |
| 58 | assert.True(t, IsValidOrigin("https://example.com:443", allowed)) |
| 59 | }) |
| 60 | |
| 61 | t.Run("http with port 80 is equivalent to without", func(t *testing.T) { |
| 62 | allowed := []string{"http://example.com:80"} |
| 63 | assert.True(t, IsValidOrigin("http://example.com", allowed)) |
| 64 | assert.True(t, IsValidOrigin("http://example.com:80", allowed)) |
| 65 | }) |
| 66 | |
| 67 | // --- Custom ports --- |
| 68 | |
| 69 | t.Run("localhost with custom port", func(t *testing.T) { |
| 70 | allowed := []string{"http://localhost:3000"} |
| 71 | assert.True(t, IsValidOrigin("http://localhost:3000", allowed)) |
| 72 | assert.True(t, IsValidOrigin("http://localhost:3000/app", allowed)) |
| 73 | assert.False(t, IsValidOrigin("http://localhost:4000", allowed)) |
| 74 | assert.False(t, IsValidOrigin("http://localhost", allowed)) |
| 75 | }) |
| 76 | |
| 77 | t.Run("domain with non-standard port", func(t *testing.T) { |
| 78 | allowed := []string{"https://staging.example.com:8443"} |
| 79 | assert.True(t, IsValidOrigin("https://staging.example.com:8443", allowed)) |
| 80 | assert.False(t, IsValidOrigin("https://staging.example.com", allowed)) |
| 81 | assert.False(t, IsValidOrigin("https://staging.example.com:9443", allowed)) |
| 82 | }) |
| 83 | |
| 84 | // --- Allowed origins without protocol --- |
| 85 | |
| 86 | t.Run("allowed origin without protocol", func(t *testing.T) { |
| 87 | allowed := []string{"example.com"} |
| 88 | assert.True(t, IsValidOrigin("https://example.com", allowed)) |
| 89 | assert.True(t, IsValidOrigin("http://example.com", allowed)) |
| 90 | assert.False(t, IsValidOrigin("https://evil.com", allowed)) |
nothing calls this directly
no test coverage detected