Function TestCORSLoginOriginOnSessionPost

rest/session_test.go:26–54

(t *testing.T)

)

func TestCORSLoginOriginOnSessionPost(t *testing.T) {

	rt := NewRestTesterPersistentConfigNoDB(t)
	defer rt.Close()

	// force TLS mode to test SameSite=None cookie attribute
	rt.ServerContext().Config.API.HTTPS.TLSCertPath = "/pretend/valid/cert"

	RequireStatus(t, rt.CreateDatabase("db", rt.NewDbConfig()), http.StatusCreated)

	reqHeaders := map[string]string{
		"Origin": "http://example.com",
	}

	response := rt.SendRequestWithHeaders("POST", "/db/_session", "{\"name\":\"jchris\",\"password\":\"secret\"}", reqHeaders)
	RequireStatus(t, response, 401)

	response = rt.SendRequestWithHeaders("POST", "/db/_facebook", `{"access_token":"true"}`, reqHeaders)
	assertGatewayStatus(t, response, 401)

	const username = "alice"
	rt.CreateUser(username, []string{"*"})

	response = rt.SendUserRequest(http.MethodPost, "/{{.db}}/_session", "", username)
	RequireStatus(t, response, http.StatusOK)
	cookie, err := http.ParseSetCookie(response.Header().Get("Set-Cookie"))
	require.NoError(t, err)
	require.Equal(t, cookie.SameSite, http.SameSiteNoneMode)
}

// #issue 991
func TestCORSLoginOriginOnSessionPostNoCORSConfig(t *testing.T) {