Function TestSecureWithConfig_HSTSExcludeSubdomains

middleware/secure_test.go:124–146

(t *testing.T)

}

func TestSecureWithConfig_HSTSExcludeSubdomains(t *testing.T) {
	// Custom with CSPReportOnly flag
	e := echo.New()
	h := func(c *echo.Context) error {
		return c.String(http.StatusOK, "test")
	}

	req := httptest.NewRequest(http.MethodGet, "/", nil)

	// Custom, with preload option enabled and subdomains excluded
	req.Header.Set(echo.HeaderXForwardedProto, "https")
	rec := httptest.NewRecorder()
	c := e.NewContext(req, rec)

	err := SecureWithConfig(SecureConfig{
		HSTSMaxAge:            3600,
		HSTSPreloadEnabled:    true,
		HSTSExcludeSubdomains: true,
	})(h)(c)
	assert.NoError(t, err)

	assert.Equal(t, "max-age=3600; preload", rec.Header().Get(echo.HeaderStrictTransportSecurity))
}