Function TestServer_CORSOrigins

lib/httpapi/server_test.go:373–529

(t *testing.T)

}

func TestServer_CORSOrigins(t *testing.T) {
	cases := []struct {
		name                   string
		allowedOrigins         []string
		originHeader           string
		expectedStatusCode     int
		expectedCORSOrigin     string
		expectCORSOriginHeader bool
		validationErrorMsg     string
	}{
		{
			name:                   "wildcard origins - any origin allowed",
			allowedOrigins:         []string{"*"},
			originHeader:           "https://example.com",
			expectedStatusCode:     http.StatusOK,
			expectedCORSOrigin:     "*",
			expectCORSOriginHeader: true,
		},
		{
			name:                   "wildcard origins - malicious origin allowed",
			allowedOrigins:         []string{"*"},
			originHeader:           "http://malicious.com",
			expectedStatusCode:     http.StatusOK,
			expectedCORSOrigin:     "*",
			expectCORSOriginHeader: true,
		},
		{
			name:                   "specific origins - valid origin allowed https",
			allowedOrigins:         []string{"https://localhost:3000", "http://app.example.com"},
			originHeader:           "https://localhost:3000",
			expectedStatusCode:     http.StatusOK,
			expectedCORSOrigin:     "https://localhost:3000",
			expectCORSOriginHeader: true,
		},
		{
			name:                   "specific origins - valid origin allowed http",
			allowedOrigins:         []string{"https://localhost:3000", "http://app.example.com"},
			originHeader:           "http://app.example.com",
			expectedStatusCode:     http.StatusOK,
			expectedCORSOrigin:     "http://app.example.com",
			expectCORSOriginHeader: true,
		},
		{
			name:                   "specific origins - invalid origin rejected",
			allowedOrigins:         []string{"https://localhost:3000", "http://app.example.com"},
			originHeader:           "https://malicious.com",
			expectedStatusCode:     http.StatusOK, // Server allows request - CORS is enforced by browser
			expectCORSOriginHeader: false,
		},
		{
			name:               "no origin header - request not coming from a browser",
			allowedOrigins:     []string{"https://example.com"},
			originHeader:       "",
			expectedStatusCode: http.StatusOK,
		},
		{
			name:               "allowed origins must not be empty",
			allowedOrigins:     []string{},