Move integration tests
This commit is contained in:
Yong Wen Chua
parent
8b6002653d
commit
830b14afed
223
src/lib.rs
223
src/lib.rs
|
|
@ -887,7 +887,6 @@ mod tests {
|
||||||
use rocket::local::Client;
|
use rocket::local::Client;
|
||||||
use rocket::http::Method;
|
use rocket::http::Method;
|
||||||
use rocket::http::{Header, Status};
|
use rocket::http::{Header, Status};
|
||||||
use rocket::State;
|
|
||||||
|
|
||||||
use super::*;
|
use super::*;
|
||||||
|
|
||||||
|
|
@ -977,7 +976,6 @@ X-Ping, accept-language"#;
|
||||||
}
|
}
|
||||||
|
|
||||||
#[get("/any")]
|
#[get("/any")]
|
||||||
#[cfg_attr(feature = "clippy_lints", allow(needless_pass_by_value))]
|
|
||||||
fn any() -> Response<&'static str> {
|
fn any() -> Response<&'static str> {
|
||||||
Response::new("Hello, world!").any()
|
Response::new("Hello, world!").any()
|
||||||
}
|
}
|
||||||
|
|
@ -999,225 +997,4 @@ X-Ping, accept-language"#;
|
||||||
assert_eq!(values, vec!["*"]);
|
assert_eq!(values, vec!["*"]);
|
||||||
assert_eq!(body_str, Some("Hello, world!".to_string()));
|
assert_eq!(body_str, Some("Hello, world!".to_string()));
|
||||||
}
|
}
|
||||||
|
|
||||||
#[options("/")]
|
|
||||||
#[allow(needless_pass_by_value)]
|
|
||||||
fn cors_options(
|
|
||||||
origin: Option<Origin>,
|
|
||||||
method: Option<AccessControlRequestMethod>,
|
|
||||||
headers: Option<AccessControlRequestHeaders>,
|
|
||||||
options: State<Options>,
|
|
||||||
) -> Result<Response<()>, Error> {
|
|
||||||
options.preflight((), origin, method, headers)
|
|
||||||
}
|
|
||||||
|
|
||||||
#[get("/")]
|
|
||||||
#[allow(needless_pass_by_value)]
|
|
||||||
fn cors(
|
|
||||||
origin: Option<Origin>,
|
|
||||||
options: State<Options>,
|
|
||||||
) -> Result<Response<&'static str>, Error> {
|
|
||||||
options.respond("Hello CORS", origin)
|
|
||||||
}
|
|
||||||
|
|
||||||
fn make_cors_options() -> Options {
|
|
||||||
let (allowed_origins, failed_origins) =
|
|
||||||
AllOrSome::new_from_str_list(&["https://www.acme.com"]);
|
|
||||||
assert!(failed_origins.is_empty());
|
|
||||||
|
|
||||||
Options {
|
|
||||||
allowed_origins: allowed_origins,
|
|
||||||
allowed_methods: [Method::Get].iter().cloned().collect(),
|
|
||||||
allowed_headers: AllOrSome::Some(
|
|
||||||
["Authorization"]
|
|
||||||
.into_iter()
|
|
||||||
.map(|s| s.to_string().into())
|
|
||||||
.collect(),
|
|
||||||
),
|
|
||||||
allow_credentials: true,
|
|
||||||
..Default::default()
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
#[test]
|
|
||||||
fn cors_options_check() {
|
|
||||||
let rocket = rocket::ignite()
|
|
||||||
.mount("/", routes![cors, cors_options])
|
|
||||||
.manage(make_cors_options());
|
|
||||||
let client = not_err!(Client::new(rocket));
|
|
||||||
|
|
||||||
let origin_header = Header::from(not_err!(
|
|
||||||
hyper::header::Origin::from_str("https://www.acme.com")
|
|
||||||
));
|
|
||||||
let method_header = Header::from(hyper::header::AccessControlRequestMethod(
|
|
||||||
hyper::method::Method::Get,
|
|
||||||
));
|
|
||||||
let request_headers = hyper::header::AccessControlRequestHeaders(
|
|
||||||
vec![FromStr::from_str("Authorization").unwrap()],
|
|
||||||
);
|
|
||||||
let request_headers = Header::from(request_headers);
|
|
||||||
let req = client
|
|
||||||
.options("/")
|
|
||||||
.header(origin_header)
|
|
||||||
.header(method_header)
|
|
||||||
.header(request_headers);
|
|
||||||
|
|
||||||
let response = req.dispatch();
|
|
||||||
assert_eq!(response.status(), Status::Ok);
|
|
||||||
}
|
|
||||||
|
|
||||||
#[test]
|
|
||||||
fn cors_get_check() {
|
|
||||||
let rocket = rocket::ignite()
|
|
||||||
.mount("/", routes![cors, cors_options])
|
|
||||||
.manage(make_cors_options());
|
|
||||||
let client = not_err!(Client::new(rocket));
|
|
||||||
|
|
||||||
let origin_header = Header::from(not_err!(
|
|
||||||
hyper::header::Origin::from_str("https://www.acme.com")
|
|
||||||
));
|
|
||||||
let authorization = Header::new("Authorization", "let me in");
|
|
||||||
let req = client.get("/").header(origin_header).header(authorization);
|
|
||||||
|
|
||||||
let mut response = req.dispatch();
|
|
||||||
assert_eq!(response.status(), Status::Ok);
|
|
||||||
let body_str = response.body().and_then(|body| body.into_string());
|
|
||||||
assert_eq!(body_str, Some("Hello CORS".to_string()));
|
|
||||||
}
|
|
||||||
|
|
||||||
/// This test is to check that non CORS compliant requests to GET should still work. (i.e. curl)
|
|
||||||
#[test]
|
|
||||||
fn cors_get_no_origin() {
|
|
||||||
let rocket = rocket::ignite()
|
|
||||||
.mount("/", routes![cors, cors_options])
|
|
||||||
.manage(make_cors_options());
|
|
||||||
let client = not_err!(Client::new(rocket));
|
|
||||||
|
|
||||||
let authorization = Header::new("Authorization", "let me in");
|
|
||||||
let req = client.get("/").header(authorization);
|
|
||||||
|
|
||||||
let mut response = req.dispatch();
|
|
||||||
assert_eq!(response.status(), Status::Ok);
|
|
||||||
let body_str = response.body().and_then(|body| body.into_string());
|
|
||||||
assert_eq!(body_str, Some("Hello CORS".to_string()));
|
|
||||||
}
|
|
||||||
|
|
||||||
#[test]
|
|
||||||
fn cors_options_bad_origin() {
|
|
||||||
let rocket = rocket::ignite()
|
|
||||||
.mount("/", routes![cors, cors_options])
|
|
||||||
.manage(make_cors_options());
|
|
||||||
let client = not_err!(Client::new(rocket));
|
|
||||||
|
|
||||||
let origin_header = Header::from(not_err!(hyper::header::Origin::from_str(
|
|
||||||
"https://www.bad-origin.com",
|
|
||||||
)));
|
|
||||||
let method_header = Header::from(hyper::header::AccessControlRequestMethod(
|
|
||||||
hyper::method::Method::Get,
|
|
||||||
));
|
|
||||||
let request_headers = hyper::header::AccessControlRequestHeaders(
|
|
||||||
vec![FromStr::from_str("Authorization").unwrap()],
|
|
||||||
);
|
|
||||||
let request_headers = Header::from(request_headers);
|
|
||||||
let req = client
|
|
||||||
.options("/")
|
|
||||||
.header(origin_header)
|
|
||||||
.header(method_header)
|
|
||||||
.header(request_headers);
|
|
||||||
|
|
||||||
let response = req.dispatch();
|
|
||||||
assert_eq!(response.status(), Status::Forbidden);
|
|
||||||
}
|
|
||||||
|
|
||||||
#[test]
|
|
||||||
fn cors_options_missing_origin() {
|
|
||||||
let rocket = rocket::ignite()
|
|
||||||
.mount("/", routes![cors, cors_options])
|
|
||||||
.manage(make_cors_options());
|
|
||||||
let client = not_err!(Client::new(rocket));
|
|
||||||
|
|
||||||
let method_header = Header::from(hyper::header::AccessControlRequestMethod(
|
|
||||||
hyper::method::Method::Get,
|
|
||||||
));
|
|
||||||
let request_headers = hyper::header::AccessControlRequestHeaders(
|
|
||||||
vec![FromStr::from_str("Authorization").unwrap()],
|
|
||||||
);
|
|
||||||
let request_headers = Header::from(request_headers);
|
|
||||||
let req = client.options("/").header(method_header).header(
|
|
||||||
request_headers,
|
|
||||||
);
|
|
||||||
|
|
||||||
let response = req.dispatch();
|
|
||||||
assert_eq!(response.status(), Status::Ok);
|
|
||||||
}
|
|
||||||
|
|
||||||
#[test]
|
|
||||||
fn cors_options_bad_request_method() {
|
|
||||||
let rocket = rocket::ignite()
|
|
||||||
.mount("/", routes![cors, cors_options])
|
|
||||||
.manage(make_cors_options());
|
|
||||||
let client = not_err!(Client::new(rocket));
|
|
||||||
|
|
||||||
let origin_header = Header::from(not_err!(
|
|
||||||
hyper::header::Origin::from_str("https://www.acme.com")
|
|
||||||
));
|
|
||||||
let method_header = Header::from(hyper::header::AccessControlRequestMethod(
|
|
||||||
hyper::method::Method::Post,
|
|
||||||
));
|
|
||||||
let request_headers = hyper::header::AccessControlRequestHeaders(
|
|
||||||
vec![FromStr::from_str("Authorization").unwrap()],
|
|
||||||
);
|
|
||||||
let request_headers = Header::from(request_headers);
|
|
||||||
let req = client
|
|
||||||
.options("/")
|
|
||||||
.header(origin_header)
|
|
||||||
.header(method_header)
|
|
||||||
.header(request_headers);
|
|
||||||
|
|
||||||
let response = req.dispatch();
|
|
||||||
assert_eq!(response.status(), Status::Forbidden);
|
|
||||||
}
|
|
||||||
|
|
||||||
#[test]
|
|
||||||
fn cors_options_bad_request_header() {
|
|
||||||
let rocket = rocket::ignite()
|
|
||||||
.mount("/", routes![cors, cors_options])
|
|
||||||
.manage(make_cors_options());
|
|
||||||
let client = not_err!(Client::new(rocket));
|
|
||||||
|
|
||||||
let origin_header = Header::from(not_err!(
|
|
||||||
hyper::header::Origin::from_str("https://www.acme.com")
|
|
||||||
));
|
|
||||||
let method_header = Header::from(hyper::header::AccessControlRequestMethod(
|
|
||||||
hyper::method::Method::Get,
|
|
||||||
));
|
|
||||||
let request_headers =
|
|
||||||
hyper::header::AccessControlRequestHeaders(vec![FromStr::from_str("Foobar").unwrap()]);
|
|
||||||
let request_headers = Header::from(request_headers);
|
|
||||||
let req = client
|
|
||||||
.options("/")
|
|
||||||
.header(origin_header)
|
|
||||||
.header(method_header)
|
|
||||||
.header(request_headers);
|
|
||||||
|
|
||||||
let response = req.dispatch();
|
|
||||||
assert_eq!(response.status(), Status::Forbidden);
|
|
||||||
}
|
|
||||||
|
|
||||||
#[test]
|
|
||||||
fn cors_get_bad_origin() {
|
|
||||||
let rocket = rocket::ignite()
|
|
||||||
.mount("/", routes![cors, cors_options])
|
|
||||||
.manage(make_cors_options());
|
|
||||||
let client = not_err!(Client::new(rocket));
|
|
||||||
|
|
||||||
let origin_header = Header::from(not_err!(hyper::header::Origin::from_str(
|
|
||||||
"https://www.bad-origin.com",
|
|
||||||
)));
|
|
||||||
let authorization = Header::new("Authorization", "let me in");
|
|
||||||
let req = client.get("/").header(origin_header).header(authorization);
|
|
||||||
|
|
||||||
let response = req.dispatch();
|
|
||||||
assert_eq!(response.status(), Status::Forbidden);
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -0,0 +1,288 @@
|
||||||
|
//! This crate tests using rocket_cors using the "classic"" per-route handling
|
||||||
|
|
||||||
|
#![feature(plugin, custom_derive)]
|
||||||
|
#![plugin(rocket_codegen)]
|
||||||
|
extern crate hyper;
|
||||||
|
extern crate rocket;
|
||||||
|
extern crate rocket_cors;
|
||||||
|
|
||||||
|
use std::str::FromStr;
|
||||||
|
|
||||||
|
use rocket::State;
|
||||||
|
use rocket::http::Method;
|
||||||
|
use rocket::http::{Header, Status};
|
||||||
|
use rocket::local::Client;
|
||||||
|
use rocket_cors::*;
|
||||||
|
|
||||||
|
#[options("/")]
|
||||||
|
fn cors_options(
|
||||||
|
origin: Option<Origin>,
|
||||||
|
method: Option<AccessControlRequestMethod>,
|
||||||
|
headers: Option<AccessControlRequestHeaders>,
|
||||||
|
options: State<rocket_cors::Options>,
|
||||||
|
) -> Result<Response<()>, Error> {
|
||||||
|
options.preflight((), origin, method, headers)
|
||||||
|
}
|
||||||
|
|
||||||
|
#[get("/")]
|
||||||
|
fn cors(
|
||||||
|
origin: Option<Origin>,
|
||||||
|
options: State<rocket_cors::Options>,
|
||||||
|
) -> Result<Response<&'static str>, Error> {
|
||||||
|
options.respond("Hello CORS", origin)
|
||||||
|
}
|
||||||
|
|
||||||
|
fn make_cors_options() -> Options {
|
||||||
|
let (allowed_origins, failed_origins) = AllOrSome::new_from_str_list(&["https://www.acme.com"]);
|
||||||
|
assert!(failed_origins.is_empty());
|
||||||
|
|
||||||
|
Options {
|
||||||
|
allowed_origins: allowed_origins,
|
||||||
|
allowed_methods: [Method::Get].iter().cloned().collect(),
|
||||||
|
allowed_headers: AllOrSome::Some(
|
||||||
|
["Authorization"]
|
||||||
|
.into_iter()
|
||||||
|
.map(|s| s.to_string().into())
|
||||||
|
.collect(),
|
||||||
|
),
|
||||||
|
allow_credentials: true,
|
||||||
|
..Default::default()
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
#[test]
|
||||||
|
fn smoke_test() {
|
||||||
|
let (allowed_origins, failed_origins) = AllOrSome::new_from_str_list(&["https://www.acme.com"]);
|
||||||
|
assert!(failed_origins.is_empty());
|
||||||
|
let cors_options = rocket_cors::Options {
|
||||||
|
allowed_origins: allowed_origins,
|
||||||
|
allowed_methods: [Method::Get].iter().cloned().collect(),
|
||||||
|
allowed_headers: AllOrSome::Some(
|
||||||
|
["Authorization"]
|
||||||
|
.iter()
|
||||||
|
.map(|s| s.to_string().into())
|
||||||
|
.collect(),
|
||||||
|
),
|
||||||
|
allow_credentials: true,
|
||||||
|
..Default::default()
|
||||||
|
};
|
||||||
|
let rocket = rocket::ignite()
|
||||||
|
.mount("/", routes![cors, cors_options])
|
||||||
|
.manage(cors_options);
|
||||||
|
let client = Client::new(rocket).unwrap();
|
||||||
|
|
||||||
|
// `Options` pre-flight checks
|
||||||
|
let origin_header = Header::from(
|
||||||
|
hyper::header::Origin::from_str("https://www.acme.com").unwrap(),
|
||||||
|
);
|
||||||
|
let method_header = Header::from(hyper::header::AccessControlRequestMethod(
|
||||||
|
hyper::method::Method::Get,
|
||||||
|
));
|
||||||
|
let request_headers = hyper::header::AccessControlRequestHeaders(
|
||||||
|
vec![FromStr::from_str("Authorization").unwrap()],
|
||||||
|
);
|
||||||
|
let request_headers = Header::from(request_headers);
|
||||||
|
let req = client
|
||||||
|
.options("/")
|
||||||
|
.header(origin_header)
|
||||||
|
.header(method_header)
|
||||||
|
.header(request_headers);
|
||||||
|
|
||||||
|
let response = req.dispatch();
|
||||||
|
assert_eq!(response.status(), Status::Ok);
|
||||||
|
|
||||||
|
// "Actual" request
|
||||||
|
let origin_header = Header::from(
|
||||||
|
hyper::header::Origin::from_str("https://www.acme.com").unwrap(),
|
||||||
|
);
|
||||||
|
let authorization = Header::new("Authorization", "let me in");
|
||||||
|
let req = client.get("/").header(origin_header).header(authorization);
|
||||||
|
|
||||||
|
let mut response = req.dispatch();
|
||||||
|
assert_eq!(response.status(), Status::Ok);
|
||||||
|
let body_str = response.body().and_then(|body| body.into_string());
|
||||||
|
assert_eq!(body_str, Some("Hello CORS".to_string()));
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
#[test]
|
||||||
|
fn cors_options_check() {
|
||||||
|
let rocket = rocket::ignite()
|
||||||
|
.mount("/", routes![cors, cors_options])
|
||||||
|
.manage(make_cors_options());
|
||||||
|
let client = Client::new(rocket).unwrap();
|
||||||
|
|
||||||
|
let origin_header = Header::from(
|
||||||
|
hyper::header::Origin::from_str("https://www.acme.com").unwrap(),
|
||||||
|
);
|
||||||
|
let method_header = Header::from(hyper::header::AccessControlRequestMethod(
|
||||||
|
hyper::method::Method::Get,
|
||||||
|
));
|
||||||
|
let request_headers = hyper::header::AccessControlRequestHeaders(
|
||||||
|
vec![FromStr::from_str("Authorization").unwrap()],
|
||||||
|
);
|
||||||
|
let request_headers = Header::from(request_headers);
|
||||||
|
let req = client
|
||||||
|
.options("/")
|
||||||
|
.header(origin_header)
|
||||||
|
.header(method_header)
|
||||||
|
.header(request_headers);
|
||||||
|
|
||||||
|
let response = req.dispatch();
|
||||||
|
assert_eq!(response.status(), Status::Ok);
|
||||||
|
}
|
||||||
|
|
||||||
|
#[test]
|
||||||
|
fn cors_get_check() {
|
||||||
|
let rocket = rocket::ignite()
|
||||||
|
.mount("/", routes![cors, cors_options])
|
||||||
|
.manage(make_cors_options());
|
||||||
|
let client = Client::new(rocket).unwrap();
|
||||||
|
|
||||||
|
let origin_header = Header::from(
|
||||||
|
hyper::header::Origin::from_str("https://www.acme.com").unwrap(),
|
||||||
|
);
|
||||||
|
let authorization = Header::new("Authorization", "let me in");
|
||||||
|
let req = client.get("/").header(origin_header).header(authorization);
|
||||||
|
|
||||||
|
let mut response = req.dispatch();
|
||||||
|
assert_eq!(response.status(), Status::Ok);
|
||||||
|
let body_str = response.body().and_then(|body| body.into_string());
|
||||||
|
assert_eq!(body_str, Some("Hello CORS".to_string()));
|
||||||
|
}
|
||||||
|
|
||||||
|
/// This test is to check that non CORS compliant requests to GET should still work. (i.e. curl)
|
||||||
|
#[test]
|
||||||
|
fn cors_get_no_origin() {
|
||||||
|
let rocket = rocket::ignite()
|
||||||
|
.mount("/", routes![cors, cors_options])
|
||||||
|
.manage(make_cors_options());
|
||||||
|
let client = Client::new(rocket).unwrap();
|
||||||
|
|
||||||
|
let authorization = Header::new("Authorization", "let me in");
|
||||||
|
let req = client.get("/").header(authorization);
|
||||||
|
|
||||||
|
let mut response = req.dispatch();
|
||||||
|
assert_eq!(response.status(), Status::Ok);
|
||||||
|
let body_str = response.body().and_then(|body| body.into_string());
|
||||||
|
assert_eq!(body_str, Some("Hello CORS".to_string()));
|
||||||
|
}
|
||||||
|
|
||||||
|
#[test]
|
||||||
|
fn cors_options_bad_origin() {
|
||||||
|
let rocket = rocket::ignite()
|
||||||
|
.mount("/", routes![cors, cors_options])
|
||||||
|
.manage(make_cors_options());
|
||||||
|
let client = Client::new(rocket).unwrap();
|
||||||
|
|
||||||
|
let origin_header = Header::from(
|
||||||
|
hyper::header::Origin::from_str("https://www.bad-origin.com").unwrap(),
|
||||||
|
);
|
||||||
|
let method_header = Header::from(hyper::header::AccessControlRequestMethod(
|
||||||
|
hyper::method::Method::Get,
|
||||||
|
));
|
||||||
|
let request_headers = hyper::header::AccessControlRequestHeaders(
|
||||||
|
vec![FromStr::from_str("Authorization").unwrap()],
|
||||||
|
);
|
||||||
|
let request_headers = Header::from(request_headers);
|
||||||
|
let req = client
|
||||||
|
.options("/")
|
||||||
|
.header(origin_header)
|
||||||
|
.header(method_header)
|
||||||
|
.header(request_headers);
|
||||||
|
|
||||||
|
let response = req.dispatch();
|
||||||
|
assert_eq!(response.status(), Status::Forbidden);
|
||||||
|
}
|
||||||
|
|
||||||
|
#[test]
|
||||||
|
fn cors_options_missing_origin() {
|
||||||
|
let rocket = rocket::ignite()
|
||||||
|
.mount("/", routes![cors, cors_options])
|
||||||
|
.manage(make_cors_options());
|
||||||
|
let client = Client::new(rocket).unwrap();
|
||||||
|
|
||||||
|
let method_header = Header::from(hyper::header::AccessControlRequestMethod(
|
||||||
|
hyper::method::Method::Get,
|
||||||
|
));
|
||||||
|
let request_headers = hyper::header::AccessControlRequestHeaders(
|
||||||
|
vec![FromStr::from_str("Authorization").unwrap()],
|
||||||
|
);
|
||||||
|
let request_headers = Header::from(request_headers);
|
||||||
|
let req = client.options("/").header(method_header).header(
|
||||||
|
request_headers,
|
||||||
|
);
|
||||||
|
|
||||||
|
let response = req.dispatch();
|
||||||
|
assert_eq!(response.status(), Status::Ok);
|
||||||
|
}
|
||||||
|
|
||||||
|
#[test]
|
||||||
|
fn cors_options_bad_request_method() {
|
||||||
|
let rocket = rocket::ignite()
|
||||||
|
.mount("/", routes![cors, cors_options])
|
||||||
|
.manage(make_cors_options());
|
||||||
|
let client = Client::new(rocket).unwrap();
|
||||||
|
|
||||||
|
let origin_header = Header::from(
|
||||||
|
hyper::header::Origin::from_str("https://www.acme.com").unwrap(),
|
||||||
|
);
|
||||||
|
let method_header = Header::from(hyper::header::AccessControlRequestMethod(
|
||||||
|
hyper::method::Method::Post,
|
||||||
|
));
|
||||||
|
let request_headers = hyper::header::AccessControlRequestHeaders(
|
||||||
|
vec![FromStr::from_str("Authorization").unwrap()],
|
||||||
|
);
|
||||||
|
let request_headers = Header::from(request_headers);
|
||||||
|
let req = client
|
||||||
|
.options("/")
|
||||||
|
.header(origin_header)
|
||||||
|
.header(method_header)
|
||||||
|
.header(request_headers);
|
||||||
|
|
||||||
|
let response = req.dispatch();
|
||||||
|
assert_eq!(response.status(), Status::Forbidden);
|
||||||
|
}
|
||||||
|
|
||||||
|
#[test]
|
||||||
|
fn cors_options_bad_request_header() {
|
||||||
|
let rocket = rocket::ignite()
|
||||||
|
.mount("/", routes![cors, cors_options])
|
||||||
|
.manage(make_cors_options());
|
||||||
|
let client = Client::new(rocket).unwrap();
|
||||||
|
|
||||||
|
let origin_header = Header::from(
|
||||||
|
hyper::header::Origin::from_str("https://www.acme.com").unwrap(),
|
||||||
|
);
|
||||||
|
let method_header = Header::from(hyper::header::AccessControlRequestMethod(
|
||||||
|
hyper::method::Method::Get,
|
||||||
|
));
|
||||||
|
let request_headers =
|
||||||
|
hyper::header::AccessControlRequestHeaders(vec![FromStr::from_str("Foobar").unwrap()]);
|
||||||
|
let request_headers = Header::from(request_headers);
|
||||||
|
let req = client
|
||||||
|
.options("/")
|
||||||
|
.header(origin_header)
|
||||||
|
.header(method_header)
|
||||||
|
.header(request_headers);
|
||||||
|
|
||||||
|
let response = req.dispatch();
|
||||||
|
assert_eq!(response.status(), Status::Forbidden);
|
||||||
|
}
|
||||||
|
|
||||||
|
#[test]
|
||||||
|
fn cors_get_bad_origin() {
|
||||||
|
let rocket = rocket::ignite()
|
||||||
|
.mount("/", routes![cors, cors_options])
|
||||||
|
.manage(make_cors_options());
|
||||||
|
let client = Client::new(rocket).unwrap();
|
||||||
|
|
||||||
|
let origin_header = Header::from(
|
||||||
|
hyper::header::Origin::from_str("https://www.bad-origin.com").unwrap(),
|
||||||
|
);
|
||||||
|
let authorization = Header::new("Authorization", "let me in");
|
||||||
|
let req = client.get("/").header(origin_header).header(authorization);
|
||||||
|
|
||||||
|
let response = req.dispatch();
|
||||||
|
assert_eq!(response.status(), Status::Forbidden);
|
||||||
|
}
|
||||||
Loading…
Reference in New Issue