72 lines
2.7 KiB
Elixir
72 lines
2.7 KiB
Elixir
defmodule ToweropsWeb.Plugs.SecurityHeadersTest do
|
|
use ToweropsWeb.ConnCase, async: true
|
|
|
|
alias ToweropsWeb.Plugs.SecurityHeaders
|
|
|
|
describe "call/2" do
|
|
test "adds security headers in production environment" do
|
|
# Save original env
|
|
original_env = Application.get_env(:towerops, :env)
|
|
|
|
try do
|
|
# Set environment to production
|
|
Application.put_env(:towerops, :env, :prod)
|
|
|
|
conn = SecurityHeaders.call(build_conn(), [])
|
|
|
|
# Verify all security headers are present
|
|
assert ["default-src 'self'" <> _] = get_resp_header(conn, "content-security-policy")
|
|
assert ["SAMEORIGIN"] = get_resp_header(conn, "x-frame-options")
|
|
assert ["nosniff"] = get_resp_header(conn, "x-content-type-options")
|
|
|
|
assert ["strict-origin-when-cross-origin"] =
|
|
get_resp_header(conn, "referrer-policy")
|
|
|
|
# Verify CSP contains required directives
|
|
[csp] = get_resp_header(conn, "content-security-policy")
|
|
assert csp =~ "default-src 'self'"
|
|
assert csp =~ "script-src 'self' 'unsafe-inline' 'unsafe-eval'"
|
|
assert csp =~ "style-src 'self' 'unsafe-inline' 'unsafe-hashes'"
|
|
assert csp =~ "img-src 'self' data: https:"
|
|
assert csp =~ "font-src 'self' data:"
|
|
assert csp =~ "connect-src 'self' ws: wss:"
|
|
assert csp =~ "frame-ancestors 'self'"
|
|
after
|
|
# Restore original env
|
|
Application.put_env(:towerops, :env, original_env)
|
|
end
|
|
end
|
|
|
|
test "does not add security headers in non-production environment" do
|
|
# Default test environment is :test, not :prod
|
|
conn = SecurityHeaders.call(build_conn(), [])
|
|
|
|
# Verify no security headers are present
|
|
assert [] = get_resp_header(conn, "content-security-policy")
|
|
assert [] = get_resp_header(conn, "x-frame-options")
|
|
assert [] = get_resp_header(conn, "x-content-type-options")
|
|
assert [] = get_resp_header(conn, "referrer-policy")
|
|
end
|
|
|
|
test "does not add security headers in development environment" do
|
|
# Save original env
|
|
original_env = Application.get_env(:towerops, :env)
|
|
|
|
try do
|
|
# Set environment to development
|
|
Application.put_env(:towerops, :env, :dev)
|
|
|
|
conn = SecurityHeaders.call(build_conn(), [])
|
|
|
|
# Verify no security headers are present
|
|
assert [] = get_resp_header(conn, "content-security-policy")
|
|
assert [] = get_resp_header(conn, "x-frame-options")
|
|
assert [] = get_resp_header(conn, "x-content-type-options")
|
|
assert [] = get_resp_header(conn, "referrer-policy")
|
|
after
|
|
# Restore original env
|
|
Application.put_env(:towerops, :env, original_env)
|
|
end
|
|
end
|
|
end
|
|
end
|