rocket_cors/tests/guard.rs

381 lines
12 KiB
Rust
Raw Normal View History

2017-07-26 06:37:02 +00:00
//! This crate tests using `rocket_cors` using the per-route handling with request guard
use rocket_cors as cors;
2017-07-14 04:26:47 +00:00
use rocket::http::hyper;
2017-07-14 04:26:47 +00:00
use rocket::http::Method;
use rocket::http::{Header, Status};
use rocket::local::blocking::Client;
use rocket::State;
use rocket::{get, options, routes};
2017-07-14 04:26:47 +00:00
static ORIGIN: hyper::HeaderName = hyper::header::ORIGIN;
static ACCESS_CONTROL_REQUEST_METHOD: hyper::HeaderName =
hyper::header::ACCESS_CONTROL_REQUEST_METHOD;
static ACCESS_CONTROL_REQUEST_HEADERS: hyper::HeaderName =
hyper::header::ACCESS_CONTROL_REQUEST_HEADERS;
2017-07-14 04:26:47 +00:00
#[get("/")]
fn cors_responder(cors: cors::Guard<'_>) -> cors::Responder<'_, '_, &str> {
cors.responder("Hello CORS")
2017-07-14 04:26:47 +00:00
}
#[get("/panic")]
fn panicking_route(_cors: cors::Guard<'_>) -> cors::Responder<'_, '_, &str> {
panic!("This route will panic");
}
/// Manually specify our own OPTIONS route
#[options("/manual")]
fn cors_manual_options(cors: cors::Guard<'_>) -> cors::Responder<'_, '_, &str> {
cors.responder("Manual CORS Preflight")
}
/// Manually specify our own OPTIONS route
#[get("/manual")]
fn cors_manual(cors: cors::Guard<'_>) -> cors::Responder<'_, '_, &str> {
cors.responder("Hello CORS")
}
/// `Responder` with String
#[get("/responder/string")]
fn responder_string(cors: cors::Guard<'_>) -> cors::Responder<'_, 'static, String> {
cors.responder("Hello CORS".to_string())
}
/// `Responder` with 'static ()
#[get("/responder/unit")]
fn responder_unit(cors: cors::Guard<'_>) -> cors::Responder<'_, 'static, ()> {
cors.responder(())
}
struct SomeState;
/// Borrow `SomeState` from Rocket
#[get("/state")]
fn state<'r, 'o: 'r>(
cors: cors::Guard<'r>,
_state: &State<SomeState>,
) -> cors::Responder<'r, 'o, &'r str> {
cors.responder("hmm")
}
fn make_cors() -> cors::Cors {
let allowed_origins = cors::AllowedOrigins::some_exact(&["https://www.acme.com"]);
2017-07-14 04:26:47 +00:00
cors::CorsOptions {
allowed_origins,
allowed_methods: vec![Method::Get].into_iter().map(From::from).collect(),
allowed_headers: cors::AllowedHeaders::some(&["Authorization", "Accept"]),
2017-07-14 04:26:47 +00:00
allow_credentials: true,
..Default::default()
}
.to_cors()
.expect("To not fail")
2017-07-14 04:26:47 +00:00
}
fn make_rocket() -> rocket::Rocket<rocket::Build> {
rocket::build()
.mount("/", routes![cors_responder, panicking_route])
.mount("/", routes![responder_string, responder_unit, state])
.mount("/", cors::catch_all_options_routes()) // mount the catch all routes
.mount("/", routes![cors_manual, cors_manual_options]) // manual OPTIOONS routes
.manage(make_cors())
.manage(SomeState)
}
2017-07-14 04:26:47 +00:00
#[test]
fn smoke_test() {
let rocket = make_rocket();
let client = Client::tracked(rocket).unwrap();
2017-07-14 04:26:47 +00:00
// `Options` pre-flight checks
let origin_header = Header::new(ORIGIN.as_str(), "https://www.acme.com");
let method_header = Header::new(
ACCESS_CONTROL_REQUEST_METHOD.as_str(),
hyper::Method::GET.as_str(),
);
let request_headers = Header::new(ACCESS_CONTROL_REQUEST_HEADERS.as_str(), "Authorization");
2017-07-14 04:26:47 +00:00
let req = client
.options("/")
.header(origin_header)
.header(method_header)
.header(request_headers);
let response = req.dispatch();
assert!(response.status().class().is_success());
2017-07-14 04:26:47 +00:00
// "Actual" request
let origin_header = Header::new(ORIGIN.as_str(), "https://www.acme.com");
2017-07-14 04:26:47 +00:00
let authorization = Header::new("Authorization", "let me in");
let req = client.get("/").header(origin_header).header(authorization);
let response = req.dispatch();
assert!(response.status().class().is_success());
let origin_header = response
.headers()
.get_one("Access-Control-Allow-Origin")
.expect("to exist");
assert_eq!("https://www.acme.com", origin_header);
let body_str = response.into_string();
assert_eq!(body_str, Some("Hello CORS".to_string()));
2017-07-14 04:26:47 +00:00
}
/// Check the "catch all" OPTIONS route works for `/`
2017-07-14 04:26:47 +00:00
#[test]
fn cors_options_catch_all_check() {
let rocket = make_rocket();
let client = Client::tracked(rocket).unwrap();
2017-07-14 04:26:47 +00:00
let origin_header = Header::new(ORIGIN.as_str(), "https://www.acme.com");
let method_header = Header::new(
ACCESS_CONTROL_REQUEST_METHOD.as_str(),
hyper::Method::GET.as_str(),
);
let request_headers = Header::new(ACCESS_CONTROL_REQUEST_HEADERS.as_str(), "Authorization");
2017-07-14 04:26:47 +00:00
let req = client
.options("/")
.header(origin_header)
.header(method_header)
.header(request_headers);
let response = req.dispatch();
assert!(response.status().class().is_success());
let origin_header = response
.headers()
.get_one("Access-Control-Allow-Origin")
.expect("to exist");
assert_eq!("https://www.acme.com", origin_header);
2017-07-14 04:26:47 +00:00
}
/// Check the "catch all" OPTIONS route works for other routes
#[test]
fn cors_options_catch_all_check_other_routes() {
let rocket = make_rocket();
let client = Client::tracked(rocket).unwrap();
let origin_header = Header::new(ORIGIN.as_str(), "https://www.acme.com");
let method_header = Header::new(
ACCESS_CONTROL_REQUEST_METHOD.as_str(),
hyper::Method::GET.as_str(),
);
let request_headers = Header::new(ACCESS_CONTROL_REQUEST_HEADERS.as_str(), "Authorization");
let req = client
.options("/response/unit")
.header(origin_header)
.header(method_header)
.header(request_headers);
let response = req.dispatch();
assert!(response.status().class().is_success());
let origin_header = response
.headers()
.get_one("Access-Control-Allow-Origin")
.expect("to exist");
assert_eq!("https://www.acme.com", origin_header);
}
2017-07-14 04:26:47 +00:00
#[test]
fn cors_get_check() {
let rocket = make_rocket();
let client = Client::tracked(rocket).unwrap();
2017-07-14 04:26:47 +00:00
let origin_header = Header::new(ORIGIN.as_str(), "https://www.acme.com");
2017-07-14 04:26:47 +00:00
let authorization = Header::new("Authorization", "let me in");
let req = client.get("/").header(origin_header).header(authorization);
let response = req.dispatch();
assert!(response.status().class().is_success());
let origin_header = response
.headers()
.get_one("Access-Control-Allow-Origin")
.expect("to exist");
assert_eq!("https://www.acme.com", origin_header);
let body_str = response.into_string();
assert_eq!(body_str, Some("Hello CORS".to_string()));
2017-07-14 04:26:47 +00:00
}
/// This test is to check that non CORS compliant requests to GET should still work. (i.e. curl)
#[test]
fn cors_get_no_origin() {
let rocket = make_rocket();
let client = Client::tracked(rocket).unwrap();
2017-07-14 04:26:47 +00:00
let authorization = Header::new("Authorization", "let me in");
let req = client.get("/").header(authorization);
let response = req.dispatch();
assert!(response.status().class().is_success());
2018-10-31 02:30:10 +00:00
assert!(response
.headers()
.get_one("Access-Control-Allow-Origin")
.is_none());
let body_str = response.into_string();
assert_eq!(body_str, Some("Hello CORS".to_string()));
2017-07-14 04:26:47 +00:00
}
#[test]
fn cors_options_bad_origin() {
let rocket = make_rocket();
let client = Client::tracked(rocket).unwrap();
2017-07-14 04:26:47 +00:00
let origin_header = Header::new(ORIGIN.as_str(), "https://www.bad-origin.com");
let method_header = Header::new(
ACCESS_CONTROL_REQUEST_METHOD.as_str(),
hyper::Method::GET.as_str(),
);
let request_headers = Header::new(ACCESS_CONTROL_REQUEST_HEADERS.as_str(), "Authorization");
2017-07-14 04:26:47 +00:00
let req = client
.options("/")
.header(origin_header)
.header(method_header)
.header(request_headers);
let response = req.dispatch();
assert_eq!(response.status(), Status::Forbidden);
2018-10-31 02:30:10 +00:00
assert!(response
.headers()
.get_one("Access-Control-Allow-Origin")
.is_none());
2017-07-14 04:26:47 +00:00
}
#[test]
fn cors_options_missing_origin() {
let rocket = make_rocket();
let client = Client::tracked(rocket).unwrap();
2017-07-14 04:26:47 +00:00
let method_header = Header::new(
ACCESS_CONTROL_REQUEST_METHOD.as_str(),
hyper::Method::GET.as_str(),
);
let request_headers = Header::new(ACCESS_CONTROL_REQUEST_HEADERS.as_str(), "Authorization");
let req = client
.options("/")
.header(method_header)
.header(request_headers);
2017-07-14 04:26:47 +00:00
let response = req.dispatch();
assert!(response.status().class().is_success());
2018-10-31 02:30:10 +00:00
assert!(response
.headers()
.get_one("Access-Control-Allow-Origin")
.is_none());
2017-07-14 04:26:47 +00:00
}
#[test]
fn cors_options_bad_request_method() {
let rocket = make_rocket();
let client = Client::tracked(rocket).unwrap();
2017-07-14 04:26:47 +00:00
let origin_header = Header::new(ORIGIN.as_str(), "https://www.acme.com");
let method_header = Header::new(
ACCESS_CONTROL_REQUEST_METHOD.as_str(),
hyper::Method::POST.as_str(),
);
let request_headers = Header::new(ACCESS_CONTROL_REQUEST_HEADERS.as_str(), "Authorization");
2017-07-14 04:26:47 +00:00
let req = client
.options("/")
.header(origin_header)
.header(method_header)
.header(request_headers);
let response = req.dispatch();
assert_eq!(response.status(), Status::Forbidden);
2018-10-31 02:30:10 +00:00
assert!(response
.headers()
.get_one("Access-Control-Allow-Origin")
.is_none());
2017-07-14 04:26:47 +00:00
}
#[test]
fn cors_options_bad_request_header() {
let rocket = make_rocket();
let client = Client::tracked(rocket).unwrap();
2017-07-14 04:26:47 +00:00
let origin_header = Header::new(ORIGIN.as_str(), "https://www.acme.com");
let method_header = Header::new(
ACCESS_CONTROL_REQUEST_METHOD.as_str(),
hyper::Method::GET.as_str(),
);
let request_headers = Header::new(ACCESS_CONTROL_REQUEST_HEADERS.as_str(), "Foobar");
2017-07-14 04:26:47 +00:00
let req = client
.options("/")
.header(origin_header)
.header(method_header)
.header(request_headers);
let response = req.dispatch();
assert_eq!(response.status(), Status::Forbidden);
2018-10-31 02:30:10 +00:00
assert!(response
.headers()
.get_one("Access-Control-Allow-Origin")
.is_none());
2017-07-14 04:26:47 +00:00
}
#[test]
fn cors_get_bad_origin() {
let rocket = make_rocket();
let client = Client::tracked(rocket).unwrap();
let origin_header = Header::new(ORIGIN.as_str(), "https://www.bad-origin.com");
let authorization = Header::new("Authorization", "let me in");
let req = client.get("/").header(origin_header).header(authorization);
let response = req.dispatch();
assert_eq!(response.status(), Status::Forbidden);
2018-10-31 02:30:10 +00:00
assert!(response
.headers()
.get_one("Access-Control-Allow-Origin")
.is_none());
}
/// This test ensures that on a failing CORS request, the route (along with its side effects)
/// should never be executed.
/// The route used will panic if executed
#[test]
fn routes_failing_checks_are_not_executed() {
let rocket = make_rocket();
let client = Client::tracked(rocket).unwrap();
2017-07-14 04:26:47 +00:00
let origin_header = Header::new(ORIGIN.as_str(), "https://www.bad-origin.com");
2017-07-14 04:26:47 +00:00
let authorization = Header::new("Authorization", "let me in");
let req = client.get("/").header(origin_header).header(authorization);
let response = req.dispatch();
assert_eq!(response.status(), Status::Forbidden);
2018-10-31 02:30:10 +00:00
assert!(response
.headers()
.get_one("Access-Control-Allow-Origin")
.is_none());
2017-07-14 04:26:47 +00:00
}
/// This test ensures that manually mounted CORS OPTIONS routes are used even in the presence of
/// a "catch all" route.
#[test]
fn overridden_options_routes_are_used() {
let rocket = make_rocket();
let client = Client::tracked(rocket).unwrap();
let origin_header = Header::new(ORIGIN.as_str(), "https://www.acme.com");
let method_header = Header::new(
ACCESS_CONTROL_REQUEST_METHOD.as_str(),
hyper::Method::GET.as_str(),
);
let request_headers = Header::new(ACCESS_CONTROL_REQUEST_HEADERS.as_str(), "Authorization");
let req = client
.options("/manual")
.header(origin_header)
.header(method_header)
.header(request_headers);
let response = req.dispatch();
assert!(response.status().class().is_success());
let origin_header = response
.headers()
.get_one("Access-Control-Allow-Origin")
.expect("to exist");
assert_eq!("https://www.acme.com", origin_header);
let body_str = response.into_string();
assert_eq!(body_str, Some("Manual CORS Preflight".to_string()));
}