2017-07-26 06:37:02 +00:00
|
|
|
//! This crate tests using `rocket_cors` using the per-route handling with request guard
|
2018-10-31 02:25:10 +00:00
|
|
|
#![feature(proc_macro_hygiene, decl_macro)]
|
2018-11-21 04:17:40 +00:00
|
|
|
use hyper;
|
|
|
|
use rocket_cors as cors;
|
2017-07-14 04:26:47 +00:00
|
|
|
|
|
|
|
use std::str::FromStr;
|
|
|
|
|
|
|
|
use rocket::http::Method;
|
|
|
|
use rocket::http::{Header, Status};
|
|
|
|
use rocket::local::Client;
|
2019-03-12 06:17:52 +00:00
|
|
|
use rocket::response::Body;
|
|
|
|
use rocket::{get, options, routes};
|
2018-07-18 05:26:33 +00:00
|
|
|
use rocket::{Response, State};
|
2017-07-14 04:26:47 +00:00
|
|
|
|
|
|
|
#[get("/")]
|
2018-11-21 04:17:40 +00:00
|
|
|
fn cors(cors: cors::Guard<'_>) -> cors::Responder<'_, &str> {
|
2017-07-17 06:28:54 +00:00
|
|
|
cors.responder("Hello CORS")
|
2017-07-14 04:26:47 +00:00
|
|
|
}
|
|
|
|
|
2017-07-17 06:41:08 +00:00
|
|
|
#[get("/panic")]
|
2018-11-21 04:17:40 +00:00
|
|
|
fn panicking_route(_cors: cors::Guard<'_>) {
|
2017-07-17 06:41:08 +00:00
|
|
|
panic!("This route will panic");
|
|
|
|
}
|
|
|
|
|
2017-07-24 07:45:53 +00:00
|
|
|
/// Manually specify our own OPTIONS route
|
|
|
|
#[options("/manual")]
|
2018-11-21 04:17:40 +00:00
|
|
|
fn cors_manual_options(cors: cors::Guard<'_>) -> cors::Responder<'_, &str> {
|
2017-07-24 07:45:53 +00:00
|
|
|
cors.responder("Manual CORS Preflight")
|
|
|
|
}
|
|
|
|
|
|
|
|
/// Manually specify our own OPTIONS route
|
|
|
|
#[get("/manual")]
|
2018-11-21 04:17:40 +00:00
|
|
|
fn cors_manual(cors: cors::Guard<'_>) -> cors::Responder<'_, &str> {
|
2017-07-24 07:45:53 +00:00
|
|
|
cors.responder("Hello CORS")
|
|
|
|
}
|
2017-07-17 06:28:54 +00:00
|
|
|
|
|
|
|
/// Using a `Response` instead of a `Responder`
|
2017-07-24 07:45:53 +00:00
|
|
|
#[get("/response")]
|
2018-11-21 04:17:40 +00:00
|
|
|
fn response(cors: cors::Guard<'_>) -> Response<'_> {
|
2017-07-17 06:28:54 +00:00
|
|
|
cors.response(Response::new())
|
|
|
|
}
|
|
|
|
|
|
|
|
/// `Responder` with String
|
2017-07-24 07:45:53 +00:00
|
|
|
#[get("/responder/string")]
|
2018-11-21 04:17:40 +00:00
|
|
|
fn responder_string(cors: cors::Guard<'_>) -> cors::Responder<'_, String> {
|
2017-07-17 06:28:54 +00:00
|
|
|
cors.responder("Hello CORS".to_string())
|
|
|
|
}
|
|
|
|
|
|
|
|
/// `Responder` with 'static ()
|
2017-07-24 07:45:53 +00:00
|
|
|
#[get("/responder/unit")]
|
2018-11-21 04:17:40 +00:00
|
|
|
fn responder_unit(cors: cors::Guard<'_>) -> cors::Responder<'_, ()> {
|
2017-07-17 06:28:54 +00:00
|
|
|
cors.responder(())
|
|
|
|
}
|
|
|
|
|
|
|
|
struct SomeState;
|
|
|
|
/// Borrow `SomeState` from Rocket
|
2017-07-24 07:45:53 +00:00
|
|
|
#[get("/state")]
|
2017-07-17 06:28:54 +00:00
|
|
|
fn state<'r>(cors: cors::Guard<'r>, _state: State<'r, SomeState>) -> cors::Responder<'r, &'r str> {
|
|
|
|
cors.responder("hmm")
|
|
|
|
}
|
|
|
|
|
2018-12-19 00:29:26 +00:00
|
|
|
fn make_cors() -> cors::Cors {
|
2019-03-12 06:00:34 +00:00
|
|
|
let allowed_origins = cors::AllowedOrigins::some_exact(&["https://www.acme.com"]);
|
2017-07-14 04:26:47 +00:00
|
|
|
|
2018-12-19 00:29:26 +00:00
|
|
|
cors::CorsOptions {
|
2019-03-12 06:17:52 +00:00
|
|
|
allowed_origins,
|
2017-07-17 08:22:45 +00:00
|
|
|
allowed_methods: vec![Method::Get].into_iter().map(From::from).collect(),
|
2017-07-19 04:25:56 +00:00
|
|
|
allowed_headers: cors::AllowedHeaders::some(&["Authorization", "Accept"]),
|
2017-07-14 04:26:47 +00:00
|
|
|
allow_credentials: true,
|
|
|
|
..Default::default()
|
|
|
|
}
|
2018-12-19 00:29:26 +00:00
|
|
|
.to_cors()
|
|
|
|
.expect("To not fail")
|
2017-07-14 04:26:47 +00:00
|
|
|
}
|
|
|
|
|
2017-07-17 06:41:08 +00:00
|
|
|
fn make_rocket() -> rocket::Rocket {
|
|
|
|
rocket::ignite()
|
2017-07-24 07:45:53 +00:00
|
|
|
.mount("/", routes![cors, panicking_route])
|
2018-10-31 02:30:10 +00:00
|
|
|
.mount(
|
|
|
|
"/",
|
|
|
|
routes![response, responder_string, responder_unit, state],
|
|
|
|
)
|
2017-07-24 07:45:53 +00:00
|
|
|
.mount("/", cors::catch_all_options_routes()) // mount the catch all routes
|
|
|
|
.mount("/", routes![cors_manual, cors_manual_options]) // manual OPTIOONS routes
|
2018-12-19 00:29:26 +00:00
|
|
|
.manage(make_cors())
|
2017-07-24 07:45:53 +00:00
|
|
|
.manage(SomeState)
|
2017-07-17 06:41:08 +00:00
|
|
|
}
|
|
|
|
|
2017-07-14 04:26:47 +00:00
|
|
|
#[test]
|
|
|
|
fn smoke_test() {
|
2017-07-17 06:41:08 +00:00
|
|
|
let rocket = make_rocket();
|
2017-07-14 04:26:47 +00:00
|
|
|
let client = Client::new(rocket).unwrap();
|
|
|
|
|
|
|
|
// `Options` pre-flight checks
|
2018-02-14 05:22:43 +00:00
|
|
|
let origin_header =
|
|
|
|
Header::from(hyper::header::Origin::from_str("https://www.acme.com").unwrap());
|
2017-07-14 04:26:47 +00:00
|
|
|
let method_header = Header::from(hyper::header::AccessControlRequestMethod(
|
|
|
|
hyper::method::Method::Get,
|
|
|
|
));
|
2018-10-31 02:30:10 +00:00
|
|
|
let request_headers =
|
|
|
|
hyper::header::AccessControlRequestHeaders(vec![
|
|
|
|
FromStr::from_str("Authorization").unwrap()
|
|
|
|
]);
|
2017-07-14 04:26:47 +00:00
|
|
|
let request_headers = Header::from(request_headers);
|
|
|
|
let req = client
|
|
|
|
.options("/")
|
|
|
|
.header(origin_header)
|
|
|
|
.header(method_header)
|
|
|
|
.header(request_headers);
|
|
|
|
|
|
|
|
let response = req.dispatch();
|
2017-07-17 06:28:54 +00:00
|
|
|
assert!(response.status().class().is_success());
|
2017-07-14 04:26:47 +00:00
|
|
|
|
|
|
|
// "Actual" request
|
2018-02-14 05:22:43 +00:00
|
|
|
let origin_header =
|
|
|
|
Header::from(hyper::header::Origin::from_str("https://www.acme.com").unwrap());
|
2017-07-14 04:26:47 +00:00
|
|
|
let authorization = Header::new("Authorization", "let me in");
|
|
|
|
let req = client.get("/").header(origin_header).header(authorization);
|
|
|
|
|
|
|
|
let mut response = req.dispatch();
|
2017-07-17 06:28:54 +00:00
|
|
|
assert!(response.status().class().is_success());
|
2019-03-12 06:17:52 +00:00
|
|
|
let body_str = response.body().and_then(Body::into_string);
|
2017-07-14 04:26:47 +00:00
|
|
|
assert_eq!(body_str, Some("Hello CORS".to_string()));
|
|
|
|
|
2017-07-19 01:51:31 +00:00
|
|
|
let origin_header = response
|
|
|
|
.headers()
|
|
|
|
.get_one("Access-Control-Allow-Origin")
|
|
|
|
.expect("to exist");
|
2017-07-19 08:26:44 +00:00
|
|
|
assert_eq!("https://www.acme.com", origin_header);
|
2017-07-14 04:26:47 +00:00
|
|
|
}
|
|
|
|
|
2017-07-24 07:45:53 +00:00
|
|
|
/// Check the "catch all" OPTIONS route works for `/`
|
2017-07-14 04:26:47 +00:00
|
|
|
#[test]
|
2017-07-24 07:45:53 +00:00
|
|
|
fn cors_options_catch_all_check() {
|
2017-07-17 06:41:08 +00:00
|
|
|
let rocket = make_rocket();
|
2017-07-14 04:26:47 +00:00
|
|
|
let client = Client::new(rocket).unwrap();
|
|
|
|
|
2018-02-14 05:22:43 +00:00
|
|
|
let origin_header =
|
|
|
|
Header::from(hyper::header::Origin::from_str("https://www.acme.com").unwrap());
|
2017-07-14 04:26:47 +00:00
|
|
|
let method_header = Header::from(hyper::header::AccessControlRequestMethod(
|
|
|
|
hyper::method::Method::Get,
|
|
|
|
));
|
2018-10-31 02:30:10 +00:00
|
|
|
let request_headers =
|
|
|
|
hyper::header::AccessControlRequestHeaders(vec![
|
|
|
|
FromStr::from_str("Authorization").unwrap()
|
|
|
|
]);
|
2017-07-14 04:26:47 +00:00
|
|
|
let request_headers = Header::from(request_headers);
|
|
|
|
let req = client
|
|
|
|
.options("/")
|
|
|
|
.header(origin_header)
|
|
|
|
.header(method_header)
|
|
|
|
.header(request_headers);
|
|
|
|
|
|
|
|
let response = req.dispatch();
|
2017-07-17 06:28:54 +00:00
|
|
|
assert!(response.status().class().is_success());
|
2017-07-19 01:51:31 +00:00
|
|
|
|
|
|
|
let origin_header = response
|
|
|
|
.headers()
|
|
|
|
.get_one("Access-Control-Allow-Origin")
|
|
|
|
.expect("to exist");
|
2017-07-19 08:26:44 +00:00
|
|
|
assert_eq!("https://www.acme.com", origin_header);
|
2017-07-14 04:26:47 +00:00
|
|
|
}
|
|
|
|
|
2017-07-24 07:45:53 +00:00
|
|
|
/// Check the "catch all" OPTIONS route works for other routes
|
|
|
|
#[test]
|
|
|
|
fn cors_options_catch_all_check_other_routes() {
|
|
|
|
let rocket = make_rocket();
|
|
|
|
let client = Client::new(rocket).unwrap();
|
|
|
|
|
2018-02-14 05:22:43 +00:00
|
|
|
let origin_header =
|
|
|
|
Header::from(hyper::header::Origin::from_str("https://www.acme.com").unwrap());
|
2017-07-24 07:45:53 +00:00
|
|
|
let method_header = Header::from(hyper::header::AccessControlRequestMethod(
|
|
|
|
hyper::method::Method::Get,
|
|
|
|
));
|
2018-10-31 02:30:10 +00:00
|
|
|
let request_headers =
|
|
|
|
hyper::header::AccessControlRequestHeaders(vec![
|
|
|
|
FromStr::from_str("Authorization").unwrap()
|
|
|
|
]);
|
2017-07-24 07:45:53 +00:00
|
|
|
let request_headers = Header::from(request_headers);
|
|
|
|
let req = client
|
|
|
|
.options("/response/unit")
|
|
|
|
.header(origin_header)
|
|
|
|
.header(method_header)
|
|
|
|
.header(request_headers);
|
|
|
|
|
|
|
|
let response = req.dispatch();
|
|
|
|
assert!(response.status().class().is_success());
|
|
|
|
|
|
|
|
let origin_header = response
|
|
|
|
.headers()
|
|
|
|
.get_one("Access-Control-Allow-Origin")
|
|
|
|
.expect("to exist");
|
|
|
|
assert_eq!("https://www.acme.com", origin_header);
|
|
|
|
}
|
|
|
|
|
2017-07-14 04:26:47 +00:00
|
|
|
#[test]
|
|
|
|
fn cors_get_check() {
|
2017-07-17 06:41:08 +00:00
|
|
|
let rocket = make_rocket();
|
2017-07-14 04:26:47 +00:00
|
|
|
let client = Client::new(rocket).unwrap();
|
|
|
|
|
2018-02-14 05:22:43 +00:00
|
|
|
let origin_header =
|
|
|
|
Header::from(hyper::header::Origin::from_str("https://www.acme.com").unwrap());
|
2017-07-14 04:26:47 +00:00
|
|
|
let authorization = Header::new("Authorization", "let me in");
|
|
|
|
let req = client.get("/").header(origin_header).header(authorization);
|
|
|
|
|
|
|
|
let mut response = req.dispatch();
|
2017-07-17 06:28:54 +00:00
|
|
|
assert!(response.status().class().is_success());
|
2019-03-12 06:17:52 +00:00
|
|
|
let body_str = response.body().and_then(Body::into_string);
|
2017-07-14 04:26:47 +00:00
|
|
|
assert_eq!(body_str, Some("Hello CORS".to_string()));
|
2017-07-19 01:51:31 +00:00
|
|
|
|
|
|
|
let origin_header = response
|
|
|
|
.headers()
|
|
|
|
.get_one("Access-Control-Allow-Origin")
|
|
|
|
.expect("to exist");
|
2017-07-19 08:26:44 +00:00
|
|
|
assert_eq!("https://www.acme.com", origin_header);
|
2017-07-14 04:26:47 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/// This test is to check that non CORS compliant requests to GET should still work. (i.e. curl)
|
|
|
|
#[test]
|
|
|
|
fn cors_get_no_origin() {
|
2017-07-17 06:41:08 +00:00
|
|
|
let rocket = make_rocket();
|
2017-07-14 04:26:47 +00:00
|
|
|
let client = Client::new(rocket).unwrap();
|
|
|
|
|
|
|
|
let authorization = Header::new("Authorization", "let me in");
|
|
|
|
let req = client.get("/").header(authorization);
|
|
|
|
|
|
|
|
let mut response = req.dispatch();
|
2017-07-17 06:28:54 +00:00
|
|
|
assert!(response.status().class().is_success());
|
2019-03-12 06:17:52 +00:00
|
|
|
let body_str = response.body().and_then(Body::into_string);
|
2017-07-14 04:26:47 +00:00
|
|
|
assert_eq!(body_str, Some("Hello CORS".to_string()));
|
2018-10-31 02:30:10 +00:00
|
|
|
assert!(response
|
|
|
|
.headers()
|
|
|
|
.get_one("Access-Control-Allow-Origin")
|
|
|
|
.is_none());
|
2017-07-14 04:26:47 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
#[test]
|
|
|
|
fn cors_options_bad_origin() {
|
2017-07-17 06:41:08 +00:00
|
|
|
let rocket = make_rocket();
|
2017-07-14 04:26:47 +00:00
|
|
|
let client = Client::new(rocket).unwrap();
|
|
|
|
|
2018-02-14 05:22:43 +00:00
|
|
|
let origin_header =
|
|
|
|
Header::from(hyper::header::Origin::from_str("https://www.bad-origin.com").unwrap());
|
2017-07-14 04:26:47 +00:00
|
|
|
let method_header = Header::from(hyper::header::AccessControlRequestMethod(
|
|
|
|
hyper::method::Method::Get,
|
|
|
|
));
|
2018-10-31 02:30:10 +00:00
|
|
|
let request_headers =
|
|
|
|
hyper::header::AccessControlRequestHeaders(vec![
|
|
|
|
FromStr::from_str("Authorization").unwrap()
|
|
|
|
]);
|
2017-07-14 04:26:47 +00:00
|
|
|
let request_headers = Header::from(request_headers);
|
|
|
|
let req = client
|
|
|
|
.options("/")
|
|
|
|
.header(origin_header)
|
|
|
|
.header(method_header)
|
|
|
|
.header(request_headers);
|
|
|
|
|
|
|
|
let response = req.dispatch();
|
|
|
|
assert_eq!(response.status(), Status::Forbidden);
|
2018-10-31 02:30:10 +00:00
|
|
|
assert!(response
|
|
|
|
.headers()
|
|
|
|
.get_one("Access-Control-Allow-Origin")
|
|
|
|
.is_none());
|
2017-07-14 04:26:47 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
#[test]
|
|
|
|
fn cors_options_missing_origin() {
|
2017-07-17 06:41:08 +00:00
|
|
|
let rocket = make_rocket();
|
2017-07-14 04:26:47 +00:00
|
|
|
let client = Client::new(rocket).unwrap();
|
|
|
|
|
|
|
|
let method_header = Header::from(hyper::header::AccessControlRequestMethod(
|
|
|
|
hyper::method::Method::Get,
|
|
|
|
));
|
2018-10-31 02:30:10 +00:00
|
|
|
let request_headers =
|
|
|
|
hyper::header::AccessControlRequestHeaders(vec![
|
|
|
|
FromStr::from_str("Authorization").unwrap()
|
|
|
|
]);
|
2017-07-14 04:26:47 +00:00
|
|
|
let request_headers = Header::from(request_headers);
|
2018-02-14 05:22:43 +00:00
|
|
|
let req = client
|
|
|
|
.options("/")
|
|
|
|
.header(method_header)
|
|
|
|
.header(request_headers);
|
2017-07-14 04:26:47 +00:00
|
|
|
|
|
|
|
let response = req.dispatch();
|
2017-07-17 06:28:54 +00:00
|
|
|
assert!(response.status().class().is_success());
|
2018-10-31 02:30:10 +00:00
|
|
|
assert!(response
|
|
|
|
.headers()
|
|
|
|
.get_one("Access-Control-Allow-Origin")
|
|
|
|
.is_none());
|
2017-07-14 04:26:47 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
#[test]
|
|
|
|
fn cors_options_bad_request_method() {
|
2017-07-17 06:41:08 +00:00
|
|
|
let rocket = make_rocket();
|
2017-07-14 04:26:47 +00:00
|
|
|
let client = Client::new(rocket).unwrap();
|
|
|
|
|
2018-02-14 05:22:43 +00:00
|
|
|
let origin_header =
|
|
|
|
Header::from(hyper::header::Origin::from_str("https://www.acme.com").unwrap());
|
2017-07-14 04:26:47 +00:00
|
|
|
let method_header = Header::from(hyper::header::AccessControlRequestMethod(
|
|
|
|
hyper::method::Method::Post,
|
|
|
|
));
|
2018-10-31 02:30:10 +00:00
|
|
|
let request_headers =
|
|
|
|
hyper::header::AccessControlRequestHeaders(vec![
|
|
|
|
FromStr::from_str("Authorization").unwrap()
|
|
|
|
]);
|
2017-07-14 04:26:47 +00:00
|
|
|
let request_headers = Header::from(request_headers);
|
|
|
|
let req = client
|
|
|
|
.options("/")
|
|
|
|
.header(origin_header)
|
|
|
|
.header(method_header)
|
|
|
|
.header(request_headers);
|
|
|
|
|
|
|
|
let response = req.dispatch();
|
|
|
|
assert_eq!(response.status(), Status::Forbidden);
|
2018-10-31 02:30:10 +00:00
|
|
|
assert!(response
|
|
|
|
.headers()
|
|
|
|
.get_one("Access-Control-Allow-Origin")
|
|
|
|
.is_none());
|
2017-07-14 04:26:47 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
#[test]
|
|
|
|
fn cors_options_bad_request_header() {
|
2017-07-17 06:41:08 +00:00
|
|
|
let rocket = make_rocket();
|
2017-07-14 04:26:47 +00:00
|
|
|
let client = Client::new(rocket).unwrap();
|
|
|
|
|
2018-02-14 05:22:43 +00:00
|
|
|
let origin_header =
|
|
|
|
Header::from(hyper::header::Origin::from_str("https://www.acme.com").unwrap());
|
2017-07-14 04:26:47 +00:00
|
|
|
let method_header = Header::from(hyper::header::AccessControlRequestMethod(
|
|
|
|
hyper::method::Method::Get,
|
|
|
|
));
|
|
|
|
let request_headers =
|
|
|
|
hyper::header::AccessControlRequestHeaders(vec![FromStr::from_str("Foobar").unwrap()]);
|
|
|
|
let request_headers = Header::from(request_headers);
|
|
|
|
let req = client
|
|
|
|
.options("/")
|
|
|
|
.header(origin_header)
|
|
|
|
.header(method_header)
|
|
|
|
.header(request_headers);
|
|
|
|
|
|
|
|
let response = req.dispatch();
|
|
|
|
assert_eq!(response.status(), Status::Forbidden);
|
2018-10-31 02:30:10 +00:00
|
|
|
assert!(response
|
|
|
|
.headers()
|
|
|
|
.get_one("Access-Control-Allow-Origin")
|
|
|
|
.is_none());
|
2017-07-14 04:26:47 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
#[test]
|
|
|
|
fn cors_get_bad_origin() {
|
2017-07-17 06:41:08 +00:00
|
|
|
let rocket = make_rocket();
|
|
|
|
let client = Client::new(rocket).unwrap();
|
|
|
|
|
2018-02-14 05:22:43 +00:00
|
|
|
let origin_header =
|
|
|
|
Header::from(hyper::header::Origin::from_str("https://www.bad-origin.com").unwrap());
|
2017-07-17 06:41:08 +00:00
|
|
|
let authorization = Header::new("Authorization", "let me in");
|
|
|
|
let req = client.get("/").header(origin_header).header(authorization);
|
|
|
|
|
|
|
|
let response = req.dispatch();
|
|
|
|
assert_eq!(response.status(), Status::Forbidden);
|
2018-10-31 02:30:10 +00:00
|
|
|
assert!(response
|
|
|
|
.headers()
|
|
|
|
.get_one("Access-Control-Allow-Origin")
|
|
|
|
.is_none());
|
2017-07-17 06:41:08 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/// This test ensures that on a failing CORS request, the route (along with its side effects)
|
|
|
|
/// should never be executed.
|
|
|
|
/// The route used will panic if executed
|
|
|
|
#[test]
|
|
|
|
fn routes_failing_checks_are_not_executed() {
|
|
|
|
let rocket = make_rocket();
|
2017-07-14 04:26:47 +00:00
|
|
|
let client = Client::new(rocket).unwrap();
|
|
|
|
|
2018-02-14 05:22:43 +00:00
|
|
|
let origin_header =
|
|
|
|
Header::from(hyper::header::Origin::from_str("https://www.bad-origin.com").unwrap());
|
2017-07-14 04:26:47 +00:00
|
|
|
let authorization = Header::new("Authorization", "let me in");
|
|
|
|
let req = client.get("/").header(origin_header).header(authorization);
|
|
|
|
|
|
|
|
let response = req.dispatch();
|
|
|
|
assert_eq!(response.status(), Status::Forbidden);
|
2018-10-31 02:30:10 +00:00
|
|
|
assert!(response
|
|
|
|
.headers()
|
|
|
|
.get_one("Access-Control-Allow-Origin")
|
|
|
|
.is_none());
|
2017-07-14 04:26:47 +00:00
|
|
|
}
|
2017-07-24 07:45:53 +00:00
|
|
|
|
|
|
|
/// This test ensures that manually mounted CORS OPTIONS routes are used even in the presence of
|
|
|
|
/// a "catch all" route.
|
|
|
|
#[test]
|
|
|
|
fn overridden_options_routes_are_used() {
|
|
|
|
let rocket = make_rocket();
|
|
|
|
let client = Client::new(rocket).unwrap();
|
|
|
|
|
2018-02-14 05:22:43 +00:00
|
|
|
let origin_header =
|
|
|
|
Header::from(hyper::header::Origin::from_str("https://www.acme.com").unwrap());
|
2017-07-24 07:45:53 +00:00
|
|
|
let method_header = Header::from(hyper::header::AccessControlRequestMethod(
|
|
|
|
hyper::method::Method::Get,
|
|
|
|
));
|
2018-10-31 02:30:10 +00:00
|
|
|
let request_headers =
|
|
|
|
hyper::header::AccessControlRequestHeaders(vec![
|
|
|
|
FromStr::from_str("Authorization").unwrap()
|
|
|
|
]);
|
2017-07-24 07:45:53 +00:00
|
|
|
let request_headers = Header::from(request_headers);
|
|
|
|
let req = client
|
|
|
|
.options("/manual")
|
|
|
|
.header(origin_header)
|
|
|
|
.header(method_header)
|
|
|
|
.header(request_headers);
|
|
|
|
|
|
|
|
let mut response = req.dispatch();
|
2019-03-12 06:17:52 +00:00
|
|
|
let body_str = response.body().and_then(Body::into_string);
|
2017-07-24 07:45:53 +00:00
|
|
|
assert!(response.status().class().is_success());
|
|
|
|
assert_eq!(body_str, Some("Manual CORS Preflight".to_string()));
|
|
|
|
|
|
|
|
let origin_header = response
|
|
|
|
.headers()
|
|
|
|
.get_one("Access-Control-Allow-Origin")
|
|
|
|
.expect("to exist");
|
|
|
|
assert_eq!("https://www.acme.com", origin_header);
|
|
|
|
}
|