rocket_cors/tests/fairing.rs

303 lines
9.4 KiB
Rust
Raw Normal View History

2017-07-26 06:37:02 +00:00
//! This crate tests using `rocket_cors` using Fairings
#![feature(proc_macro_hygiene, decl_macro)]
use hyper;
2017-07-14 04:26:47 +00:00
use std::str::FromStr;
use rocket::http::Method;
use rocket::http::{Header, Status};
use rocket::local::Client;
2019-03-12 06:17:52 +00:00
use rocket::response::Body;
use rocket::{get, routes};
2017-07-14 04:26:47 +00:00
use rocket_cors::*;
#[get("/")]
fn cors<'a>() -> &'a str {
"Hello CORS"
2017-07-14 04:26:47 +00:00
}
#[get("/panic")]
fn panicking_route() {
panic!("This route will panic");
}
fn make_cors() -> Cors {
2019-03-12 06:00:34 +00:00
let allowed_origins = AllowedOrigins::some_exact(&["https://www.acme.com"]);
2017-07-14 04:26:47 +00:00
CorsOptions {
2019-03-12 06:17:52 +00:00
allowed_origins,
allowed_methods: vec![Method::Get].into_iter().map(From::from).collect(),
allowed_headers: AllowedHeaders::some(&["Authorization", "Accept"]),
2017-07-14 04:26:47 +00:00
allow_credentials: true,
..Default::default()
}
.to_cors()
.expect("To not fail")
2017-07-14 04:26:47 +00:00
}
fn rocket() -> rocket::Rocket {
rocket::ignite()
.mount("/", routes![cors, panicking_route])
.attach(make_cors())
}
2017-07-14 04:26:47 +00:00
#[test]
fn smoke_test() {
let client = Client::new(rocket()).unwrap();
2017-07-14 04:26:47 +00:00
// `Options` pre-flight checks
let origin_header =
Header::from(hyper::header::Origin::from_str("https://www.acme.com").unwrap());
2017-07-14 04:26:47 +00:00
let method_header = Header::from(hyper::header::AccessControlRequestMethod(
hyper::method::Method::Get,
));
2018-10-31 02:30:10 +00:00
let request_headers =
hyper::header::AccessControlRequestHeaders(vec![
FromStr::from_str("Authorization").unwrap()
]);
2017-07-14 04:26:47 +00:00
let request_headers = Header::from(request_headers);
let req = client
.options("/")
.header(origin_header)
.header(method_header)
.header(request_headers);
let response = req.dispatch();
assert!(response.status().class().is_success());
2017-07-14 04:26:47 +00:00
// "Actual" request
let origin_header =
Header::from(hyper::header::Origin::from_str("https://www.acme.com").unwrap());
2017-07-14 04:26:47 +00:00
let authorization = Header::new("Authorization", "let me in");
let req = client.get("/").header(origin_header).header(authorization);
let mut response = req.dispatch();
assert!(response.status().class().is_success());
2019-03-12 06:17:52 +00:00
let body_str = response.body().and_then(Body::into_string);
2017-07-14 04:26:47 +00:00
assert_eq!(body_str, Some("Hello CORS".to_string()));
let origin_header = response
.headers()
.get_one("Access-Control-Allow-Origin")
.expect("to exist");
assert_eq!("https://www.acme.com", origin_header);
2017-07-14 04:26:47 +00:00
}
#[test]
fn cors_options_check() {
let client = Client::new(rocket()).unwrap();
2017-07-14 04:26:47 +00:00
let origin_header =
Header::from(hyper::header::Origin::from_str("https://www.acme.com").unwrap());
2017-07-14 04:26:47 +00:00
let method_header = Header::from(hyper::header::AccessControlRequestMethod(
hyper::method::Method::Get,
));
2018-10-31 02:30:10 +00:00
let request_headers =
hyper::header::AccessControlRequestHeaders(vec![
FromStr::from_str("Authorization").unwrap()
]);
2017-07-14 04:26:47 +00:00
let request_headers = Header::from(request_headers);
let req = client
.options("/")
.header(origin_header)
.header(method_header)
.header(request_headers);
let response = req.dispatch();
assert!(response.status().class().is_success());
let origin_header = response
.headers()
.get_one("Access-Control-Allow-Origin")
.expect("to exist");
assert_eq!("https://www.acme.com", origin_header);
2017-07-14 04:26:47 +00:00
}
#[test]
fn cors_get_check() {
let client = Client::new(rocket()).unwrap();
2017-07-14 04:26:47 +00:00
let origin_header =
Header::from(hyper::header::Origin::from_str("https://www.acme.com").unwrap());
2017-07-14 04:26:47 +00:00
let authorization = Header::new("Authorization", "let me in");
let req = client.get("/").header(origin_header).header(authorization);
let mut response = req.dispatch();
assert!(response.status().class().is_success());
2019-03-12 06:17:52 +00:00
let body_str = response.body().and_then(Body::into_string);
2017-07-14 04:26:47 +00:00
assert_eq!(body_str, Some("Hello CORS".to_string()));
let origin_header = response
.headers()
.get_one("Access-Control-Allow-Origin")
.expect("to exist");
assert_eq!("https://www.acme.com", origin_header);
2017-07-14 04:26:47 +00:00
}
/// This test is to check that non CORS compliant requests to GET should still work. (i.e. curl)
#[test]
fn cors_get_no_origin() {
let client = Client::new(rocket()).unwrap();
2017-07-14 04:26:47 +00:00
let authorization = Header::new("Authorization", "let me in");
let req = client.get("/").header(authorization);
let mut response = req.dispatch();
assert!(response.status().class().is_success());
2019-03-12 06:17:52 +00:00
let body_str = response.body().and_then(Body::into_string);
2017-07-14 04:26:47 +00:00
assert_eq!(body_str, Some("Hello CORS".to_string()));
}
#[test]
fn cors_options_bad_origin() {
let client = Client::new(rocket()).unwrap();
2017-07-14 04:26:47 +00:00
let origin_header =
Header::from(hyper::header::Origin::from_str("https://www.bad-origin.com").unwrap());
2017-07-14 04:26:47 +00:00
let method_header = Header::from(hyper::header::AccessControlRequestMethod(
hyper::method::Method::Get,
));
2018-10-31 02:30:10 +00:00
let request_headers =
hyper::header::AccessControlRequestHeaders(vec![
FromStr::from_str("Authorization").unwrap()
]);
2017-07-14 04:26:47 +00:00
let request_headers = Header::from(request_headers);
let req = client
.options("/")
.header(origin_header)
.header(method_header)
.header(request_headers);
let response = req.dispatch();
assert_eq!(response.status(), Status::Forbidden);
}
/// Unlike the "ad-hoc" mode, this should return 404 because we don't have such a route
2017-07-14 04:26:47 +00:00
#[test]
fn cors_options_missing_origin() {
let client = Client::new(rocket()).unwrap();
2017-07-14 04:26:47 +00:00
let method_header = Header::from(hyper::header::AccessControlRequestMethod(
hyper::method::Method::Get,
));
2018-10-31 02:30:10 +00:00
let request_headers =
hyper::header::AccessControlRequestHeaders(vec![
FromStr::from_str("Authorization").unwrap()
]);
2017-07-14 04:26:47 +00:00
let request_headers = Header::from(request_headers);
let req = client
.options("/")
.header(method_header)
.header(request_headers);
2017-07-14 04:26:47 +00:00
let response = req.dispatch();
assert_eq!(response.status(), Status::NotFound);
2018-10-31 02:30:10 +00:00
assert!(response
.headers()
.get_one("Access-Control-Allow-Origin")
.is_none());
2017-07-14 04:26:47 +00:00
}
#[test]
fn cors_options_bad_request_method() {
let client = Client::new(rocket()).unwrap();
2017-07-14 04:26:47 +00:00
let origin_header =
Header::from(hyper::header::Origin::from_str("https://www.acme.com").unwrap());
2017-07-14 04:26:47 +00:00
let method_header = Header::from(hyper::header::AccessControlRequestMethod(
hyper::method::Method::Post,
));
2018-10-31 02:30:10 +00:00
let request_headers =
hyper::header::AccessControlRequestHeaders(vec![
FromStr::from_str("Authorization").unwrap()
]);
2017-07-14 04:26:47 +00:00
let request_headers = Header::from(request_headers);
let req = client
.options("/")
.header(origin_header)
.header(method_header)
.header(request_headers);
let response = req.dispatch();
assert_eq!(response.status(), Status::Forbidden);
2018-10-31 02:30:10 +00:00
assert!(response
.headers()
.get_one("Access-Control-Allow-Origin")
.is_none());
2017-07-14 04:26:47 +00:00
}
#[test]
fn cors_options_bad_request_header() {
let client = Client::new(rocket()).unwrap();
2017-07-14 04:26:47 +00:00
let origin_header =
Header::from(hyper::header::Origin::from_str("https://www.acme.com").unwrap());
2017-07-14 04:26:47 +00:00
let method_header = Header::from(hyper::header::AccessControlRequestMethod(
hyper::method::Method::Get,
));
let request_headers =
hyper::header::AccessControlRequestHeaders(vec![FromStr::from_str("Foobar").unwrap()]);
let request_headers = Header::from(request_headers);
let req = client
.options("/")
.header(origin_header)
.header(method_header)
.header(request_headers);
let response = req.dispatch();
assert_eq!(response.status(), Status::Forbidden);
2018-10-31 02:30:10 +00:00
assert!(response
.headers()
.get_one("Access-Control-Allow-Origin")
.is_none());
2017-07-14 04:26:47 +00:00
}
#[test]
fn cors_get_bad_origin() {
let client = Client::new(rocket()).unwrap();
2017-07-14 04:26:47 +00:00
let origin_header =
Header::from(hyper::header::Origin::from_str("https://www.bad-origin.com").unwrap());
2017-07-14 04:26:47 +00:00
let authorization = Header::new("Authorization", "let me in");
let req = client.get("/").header(origin_header).header(authorization);
let response = req.dispatch();
assert_eq!(response.status(), Status::Forbidden);
2018-10-31 02:30:10 +00:00
assert!(response
.headers()
.get_one("Access-Control-Allow-Origin")
.is_none());
2017-07-14 04:26:47 +00:00
}
/// This test ensures that on a failing CORS request, the route (along with its side effects)
/// should never be executed.
/// The route used will panic if executed
#[test]
fn routes_failing_checks_are_not_executed() {
let client = Client::new(rocket()).unwrap();
let origin_header =
Header::from(hyper::header::Origin::from_str("https://www.bad-origin.com").unwrap());
let method_header = Header::from(hyper::header::AccessControlRequestMethod(
hyper::method::Method::Get,
));
2018-10-31 02:30:10 +00:00
let request_headers =
hyper::header::AccessControlRequestHeaders(vec![
FromStr::from_str("Authorization").unwrap()
]);
let request_headers = Header::from(request_headers);
let req = client
.options("/panic")
.header(origin_header)
.header(method_header)
.header(request_headers);
let response = req.dispatch();
assert_eq!(response.status(), Status::Forbidden);
2018-10-31 02:30:10 +00:00
assert!(response
.headers()
.get_one("Access-Control-Allow-Origin")
.is_none());
}