Function TestServer_AllowedHosts

lib/httpapi/server_test.go:109–286

(t *testing.T)

}

func TestServer_AllowedHosts(t *testing.T) {
	cases := []struct {
		name               string
		allowedHosts       []string
		hostHeader         string
		expectedStatusCode int
		expectedErrorMsg   string
		validationErrorMsg string
	}{
		{
			name:               "wildcard hosts - any host allowed",
			allowedHosts:       []string{"*"},
			hostHeader:         "example.com",
			expectedStatusCode: http.StatusOK,
		},
		{
			name:               "wildcard hosts - another host allowed",
			allowedHosts:       []string{"*"},
			hostHeader:         "malicious.com",
			expectedStatusCode: http.StatusOK,
		},
		{
			name:               "specific hosts - valid host allowed",
			allowedHosts:       []string{"localhost", "app.example.com"},
			hostHeader:         "localhost:3000",
			expectedStatusCode: http.StatusOK,
		},
		{
			name:               "specific hosts - another valid host allowed",
			allowedHosts:       []string{"localhost", "app.example.com"},
			hostHeader:         "app.example.com",
			expectedStatusCode: http.StatusOK,
		},
		{
			name:               "specific hosts - invalid host rejected",
			allowedHosts:       []string{"localhost", "app.example.com"},
			hostHeader:         "malicious.com",
			expectedStatusCode: http.StatusBadRequest,
			expectedErrorMsg:   "Invalid host header. Allowed hosts: localhost, app.example.com",
		},
		{
			name:               "ipv6 bracketed configured allowed - with port",
			allowedHosts:       []string{"[2001:db8::1]"},
			hostHeader:         "[2001:db8::1]:80",
			expectedStatusCode: http.StatusOK,
		},
		{
			name:               "ipv6 literal invalid host rejected",
			allowedHosts:       []string{"[2001:db8::1]"},
			hostHeader:         "[2001:db8::2]",
			expectedStatusCode: http.StatusBadRequest,
			expectedErrorMsg:   "Invalid host header. Allowed hosts: 2001:db8::1",
		},
		{
			name:               "allowed hosts must not be empty",
			allowedHosts:       []string{},
			validationErrorMsg: "the list must not be empty",
		},