csrf-protection.test.js — astro Source File

Source Code

import assert from 'node:assert/strict';
import { before, describe, it } from 'node:test';
import testAdapter from './test-adapter.js';
import { loadFixture } from './test-utils.js';

describe('CSRF origin check', () => {
	let app;

	before(async () => {
		const fixture = await loadFixture({
			root: './fixtures/csrf-check-origin/',
			adapter: testAdapter(),
		});
		await fixture.build();
		app = await fixture.loadTestAdapterApp();
	});

	it("return 403 when the origin doesn't match and calling a POST", async () => {
		let request;
		let response;
		request = new Request('http://example.com/api/', {
			headers: { origin: 'http://loreum.com', 'content-type': 'multipart/form-data' },
			method: 'POST',
		});
		response = await app.render(request);
		assert.equal(response.status, 403);

		// case where content-type has different casing
		request = new Request('http://example.com/api/', {
			headers: { origin: 'http://loreum.com', 'content-type': 'MULTIPART/FORM-DATA' },
			method: 'POST',
		});
		response = await app.render(request);
		assert.equal(response.status, 403);

		request = new Request('http://example.com/api/', {
			headers: { origin: 'http://loreum.com', 'content-type': 'application/x-www-form-urlencoded' },
			method: 'POST',
		});
		response = await app.render(request);
		assert.equal(response.status, 403);

		request = new Request('http://example.com/api/', {
			headers: { origin: 'http://loreum.com', 'content-type': 'text/plain' },
			method: 'POST',
		});
		response = await app.render(request);
		assert.equal(response.status, 403);

		request = new Request('http://example.com/api/', {
			headers: {
				origin: 'http://loreum.com',
				'content-type': 'application/x-www-form-urlencoded; some-other-value',
			},
			method: 'POST',
		});
		response = await app.render(request);
		assert.equal(response.status, 403);

		request = new Request('http://example.com/api/', {
// ... (206 more lines)