16 lines
1009 B
TypeScript
16 lines
1009 B
TypeScript
import assert from 'node:assert/strict';
|
|
import {test} from 'node:test';
|
|
import {POST} from '../app/api/audit/route.ts';
|
|
const request=(origin:string,host:string)=>new Request('http://localhost:5173/courses/api/audit',{method:'POST',headers:{Origin:origin,Host:host,'Content-Type':'application/json'},body:JSON.stringify({action:'invalid'})});
|
|
test('development accepts the actual browser Host, not Next internal localhost',async()=>{
|
|
delete process.env.COURSES_ORIGIN;
|
|
assert.equal((await POST(request('http://127.0.0.1:5173','127.0.0.1:5173'))).status,400);
|
|
assert.equal((await POST(request('https://other.example','127.0.0.1:5173'))).status,403);
|
|
});
|
|
test('canonical production origin works behind a proxy and rejects another site',async()=>{
|
|
process.env.COURSES_ORIGIN='https://miem.space';
|
|
assert.equal((await POST(request('https://miem.space','internal:3000'))).status,400);
|
|
assert.equal((await POST(request('https://other.example','internal:3000'))).status,403);
|
|
delete process.env.COURSES_ORIGIN;
|
|
});
|