Graham McIntire
39e588c686
- Add organization membership check before API token creation - Fix admin security allowlist form reading current_user instead of current_scope.user - Use recursive File.ls instead of Path.wildcard to include hidden files in MIB validation - Add upload size check before ZIP extraction in MIB controller - Centralize CSP in SecurityHeaders plug with per-request nonces instead of 'unsafe-inline'
28 lines
1.2 KiB
Elixir
28 lines
1.2 KiB
Elixir
defmodule ToweropsWeb.Plugs.SecurityHeadersTest do
|
|
use ToweropsWeb.ConnCase, async: true
|
|
|
|
alias ToweropsWeb.Plugs.SecurityHeaders
|
|
|
|
describe "call/2" do
|
|
test "adds security headers to all responses" do
|
|
conn = SecurityHeaders.call(build_conn(), [])
|
|
|
|
assert ["default-src 'self'" <> _] = get_resp_header(conn, "content-security-policy")
|
|
assert ["DENY"] = get_resp_header(conn, "x-frame-options")
|
|
assert ["nosniff"] = get_resp_header(conn, "x-content-type-options")
|
|
assert ["strict-origin-when-cross-origin"] = get_resp_header(conn, "referrer-policy")
|
|
assert ["browsing-topics=()"] = get_resp_header(conn, "permissions-policy")
|
|
|
|
[csp] = get_resp_header(conn, "content-security-policy")
|
|
assert csp =~ "default-src 'self'"
|
|
assert csp =~ "script-src 'self' 'nonce-"
|
|
assert csp =~ "https://a.w5isp.com"
|
|
refute csp =~ "unsafe-eval"
|
|
assert csp =~ "style-src 'self' 'unsafe-inline' 'unsafe-hashes'"
|
|
assert csp =~ "img-src 'self' data: https:"
|
|
assert csp =~ "font-src 'self' data:"
|
|
assert csp =~ "connect-src 'self' ws: wss: https://a.w5isp.com"
|
|
assert csp =~ "frame-ancestors 'none'"
|
|
end
|
|
end
|
|
end
|