Implement CORS Fairing (#9)

* Add validate to Cors

* Skeleton

* Refactor to allow for fairings to be even built

* Errors are not handled properly

* Response no longer validates

* Ad-hoc response now use response guards

* Seems like lifetime proliferation

* Wrap Response in a Guard with some dummy lifetime

* Fairing implementation
This commit is contained in:
Yong Wen Chua 2017-07-17 14:28:54 +08:00 committed by GitHub
parent 6f1a24e12d
commit a90556c470
4 changed files with 932 additions and 657 deletions

1271
src/lib.rs

File diff suppressed because it is too large Load Diff

View File

@ -1,37 +1,68 @@
//! This crate tests using rocket_cors using the "classic" per-route handling //! This crate tests using rocket_cors using the "classic" ad-hoc per-route handling
#![feature(plugin, custom_derive)] #![feature(plugin, custom_derive)]
#![plugin(rocket_codegen)] #![plugin(rocket_codegen)]
extern crate hyper; extern crate hyper;
extern crate rocket; extern crate rocket;
extern crate rocket_cors; extern crate rocket_cors as cors;
use std::str::FromStr; use std::str::FromStr;
use rocket::State; use rocket::{Response, State};
use rocket::http::Method; use rocket::http::Method;
use rocket::http::{Header, Status}; use rocket::http::{Header, Status};
use rocket::local::Client; use rocket::local::Client;
use rocket_cors::*;
#[options("/")] #[options("/")]
fn cors_options(options: State<rocket_cors::Cors>) -> Responder<&str> { fn cors_options(cors: cors::Guard) -> cors::Responder<&str> {
rocket_cors::respond(options, "") cors.responder("")
} }
#[get("/")] #[get("/")]
fn cors(options: State<rocket_cors::Cors>) -> Responder<&str> { fn cors(cors: cors::Guard) -> cors::Responder<&str> {
rocket_cors::respond(options, "Hello CORS") cors.responder("Hello CORS")
} }
fn make_cors_options() -> Cors { // The following routes tests that the routes can be compiled with ad-hoc CORS Response/Responders
let (allowed_origins, failed_origins) = AllOrSome::new_from_str_list(&["https://www.acme.com"]);
/// Using a `Response` instead of a `Responder`
#[allow(unmounted_route)]
#[get("/")]
fn response(cors: cors::Guard) -> Response {
cors.response(Response::new())
}
/// `Responder` with String
#[allow(unmounted_route)]
#[get("/")]
fn responder_string(cors: cors::Guard) -> cors::Responder<String> {
cors.responder("Hello CORS".to_string())
}
/// `Responder` with 'static ()
#[allow(unmounted_route)]
#[get("/")]
fn responder_unit(cors: cors::Guard) -> cors::Responder<()> {
cors.responder(())
}
struct SomeState;
/// Borrow `SomeState` from Rocket
#[allow(unmounted_route)]
#[get("/")]
fn state<'r>(cors: cors::Guard<'r>, _state: State<'r, SomeState>) -> cors::Responder<'r, &'r str> {
cors.responder("hmm")
}
fn make_cors_options() -> cors::Cors {
let (allowed_origins, failed_origins) =
cors::AllOrSome::new_from_str_list(&["https://www.acme.com"]);
assert!(failed_origins.is_empty()); assert!(failed_origins.is_empty());
Cors { cors::Cors {
allowed_origins: allowed_origins, allowed_origins: allowed_origins,
allowed_methods: [Method::Get].iter().cloned().collect(), allowed_methods: [Method::Get].iter().cloned().collect(),
allowed_headers: AllOrSome::Some( allowed_headers: cors::AllOrSome::Some(
["Authorization"] ["Authorization"]
.into_iter() .into_iter()
.map(|s| s.to_string().into()) .map(|s| s.to_string().into())
@ -44,12 +75,13 @@ fn make_cors_options() -> Cors {
#[test] #[test]
fn smoke_test() { fn smoke_test() {
let (allowed_origins, failed_origins) = AllOrSome::new_from_str_list(&["https://www.acme.com"]); let (allowed_origins, failed_origins) =
cors::AllOrSome::new_from_str_list(&["https://www.acme.com"]);
assert!(failed_origins.is_empty()); assert!(failed_origins.is_empty());
let cors_options = rocket_cors::Cors { let cors_options = cors::Cors {
allowed_origins: allowed_origins, allowed_origins: allowed_origins,
allowed_methods: [Method::Get].iter().cloned().collect(), allowed_methods: [Method::Get].iter().cloned().collect(),
allowed_headers: AllOrSome::Some( allowed_headers: cors::AllOrSome::Some(
["Authorization"] ["Authorization"]
.iter() .iter()
.map(|s| s.to_string().into()) .map(|s| s.to_string().into())
@ -81,7 +113,7 @@ fn smoke_test() {
.header(request_headers); .header(request_headers);
let response = req.dispatch(); let response = req.dispatch();
assert_eq!(response.status(), Status::Ok); assert!(response.status().class().is_success());
// "Actual" request // "Actual" request
let origin_header = Header::from( let origin_header = Header::from(
@ -91,7 +123,7 @@ fn smoke_test() {
let req = client.get("/").header(origin_header).header(authorization); let req = client.get("/").header(origin_header).header(authorization);
let mut response = req.dispatch(); let mut response = req.dispatch();
assert_eq!(response.status(), Status::Ok); assert!(response.status().class().is_success());
let body_str = response.body().and_then(|body| body.into_string()); let body_str = response.body().and_then(|body| body.into_string());
assert_eq!(body_str, Some("Hello CORS".to_string())); assert_eq!(body_str, Some("Hello CORS".to_string()));
@ -121,7 +153,7 @@ fn cors_options_check() {
.header(request_headers); .header(request_headers);
let response = req.dispatch(); let response = req.dispatch();
assert_eq!(response.status(), Status::Ok); assert!(response.status().class().is_success());
} }
#[test] #[test]
@ -139,7 +171,7 @@ fn cors_get_check() {
let mut response = req.dispatch(); let mut response = req.dispatch();
println!("{:?}", response); println!("{:?}", response);
assert_eq!(response.status(), Status::Ok); assert!(response.status().class().is_success());
let body_str = response.body().and_then(|body| body.into_string()); let body_str = response.body().and_then(|body| body.into_string());
assert_eq!(body_str, Some("Hello CORS".to_string())); assert_eq!(body_str, Some("Hello CORS".to_string()));
} }
@ -156,7 +188,7 @@ fn cors_get_no_origin() {
let req = client.get("/").header(authorization); let req = client.get("/").header(authorization);
let mut response = req.dispatch(); let mut response = req.dispatch();
assert_eq!(response.status(), Status::Ok); assert!(response.status().class().is_success());
let body_str = response.body().and_then(|body| body.into_string()); let body_str = response.body().and_then(|body| body.into_string());
assert_eq!(body_str, Some("Hello CORS".to_string())); assert_eq!(body_str, Some("Hello CORS".to_string()));
} }
@ -207,7 +239,7 @@ fn cors_options_missing_origin() {
); );
let response = req.dispatch(); let response = req.dispatch();
assert_eq!(response.status(), Status::Ok); assert!(response.status().class().is_success());
} }
#[test] #[test]

240
tests/fairings.rs Normal file
View File

@ -0,0 +1,240 @@
//! This crate tests using rocket_cors using Fairings
#![feature(plugin, custom_derive)]
#![plugin(rocket_codegen)]
extern crate hyper;
extern crate rocket;
extern crate rocket_cors;
use std::str::FromStr;
use rocket::http::Method;
use rocket::http::{Header, Status};
use rocket::local::Client;
use rocket_cors::*;
#[get("/")]
fn cors<'a>() -> &'a str {
"Hello CORS"
}
fn make_cors_options() -> Cors {
let (allowed_origins, failed_origins) = AllOrSome::new_from_str_list(&["https://www.acme.com"]);
assert!(failed_origins.is_empty());
Cors {
allowed_origins: allowed_origins,
allowed_methods: [Method::Get].iter().cloned().collect(),
allowed_headers: AllOrSome::Some(
["Authorization"]
.into_iter()
.map(|s| s.to_string().into())
.collect(),
),
allow_credentials: true,
..Default::default()
}
}
fn rocket() -> rocket::Rocket {
rocket::ignite().mount("/", routes![cors]).attach(
make_cors_options(),
)
}
#[test]
fn smoke_test() {
let client = Client::new(rocket()).unwrap();
// `Options` pre-flight checks
let origin_header = Header::from(
hyper::header::Origin::from_str("https://www.acme.com").unwrap(),
);
let method_header = Header::from(hyper::header::AccessControlRequestMethod(
hyper::method::Method::Get,
));
let request_headers = hyper::header::AccessControlRequestHeaders(
vec![FromStr::from_str("Authorization").unwrap()],
);
let request_headers = Header::from(request_headers);
let req = client
.options("/")
.header(origin_header)
.header(method_header)
.header(request_headers);
let response = req.dispatch();
assert!(response.status().class().is_success());
// "Actual" request
let origin_header = Header::from(
hyper::header::Origin::from_str("https://www.acme.com").unwrap(),
);
let authorization = Header::new("Authorization", "let me in");
let req = client.get("/").header(origin_header).header(authorization);
let mut response = req.dispatch();
assert!(response.status().class().is_success());
let body_str = response.body().and_then(|body| body.into_string());
assert_eq!(body_str, Some("Hello CORS".to_string()));
}
#[test]
fn cors_options_check() {
let client = Client::new(rocket()).unwrap();
let origin_header = Header::from(
hyper::header::Origin::from_str("https://www.acme.com").unwrap(),
);
let method_header = Header::from(hyper::header::AccessControlRequestMethod(
hyper::method::Method::Get,
));
let request_headers = hyper::header::AccessControlRequestHeaders(
vec![FromStr::from_str("Authorization").unwrap()],
);
let request_headers = Header::from(request_headers);
let req = client
.options("/")
.header(origin_header)
.header(method_header)
.header(request_headers);
let response = req.dispatch();
assert!(response.status().class().is_success());
}
#[test]
fn cors_get_check() {
let client = Client::new(rocket()).unwrap();
let origin_header = Header::from(
hyper::header::Origin::from_str("https://www.acme.com").unwrap(),
);
let authorization = Header::new("Authorization", "let me in");
let req = client.get("/").header(origin_header).header(authorization);
let mut response = req.dispatch();
println!("{:?}", response);
assert!(response.status().class().is_success());
let body_str = response.body().and_then(|body| body.into_string());
assert_eq!(body_str, Some("Hello CORS".to_string()));
}
/// This test is to check that non CORS compliant requests to GET should still work. (i.e. curl)
#[test]
fn cors_get_no_origin() {
let client = Client::new(rocket()).unwrap();
let authorization = Header::new("Authorization", "let me in");
let req = client.get("/").header(authorization);
let mut response = req.dispatch();
assert!(response.status().class().is_success());
let body_str = response.body().and_then(|body| body.into_string());
assert_eq!(body_str, Some("Hello CORS".to_string()));
}
#[test]
fn cors_options_bad_origin() {
let client = Client::new(rocket()).unwrap();
let origin_header = Header::from(
hyper::header::Origin::from_str("https://www.bad-origin.com").unwrap(),
);
let method_header = Header::from(hyper::header::AccessControlRequestMethod(
hyper::method::Method::Get,
));
let request_headers = hyper::header::AccessControlRequestHeaders(
vec![FromStr::from_str("Authorization").unwrap()],
);
let request_headers = Header::from(request_headers);
let req = client
.options("/")
.header(origin_header)
.header(method_header)
.header(request_headers);
let response = req.dispatch();
assert_eq!(response.status(), Status::Forbidden);
}
#[test]
fn cors_options_missing_origin() {
let client = Client::new(rocket()).unwrap();
let method_header = Header::from(hyper::header::AccessControlRequestMethod(
hyper::method::Method::Get,
));
let request_headers = hyper::header::AccessControlRequestHeaders(
vec![FromStr::from_str("Authorization").unwrap()],
);
let request_headers = Header::from(request_headers);
let req = client.options("/").header(method_header).header(
request_headers,
);
let response = req.dispatch();
assert!(response.status().class().is_success());
}
#[test]
fn cors_options_bad_request_method() {
let client = Client::new(rocket()).unwrap();
let origin_header = Header::from(
hyper::header::Origin::from_str("https://www.acme.com").unwrap(),
);
let method_header = Header::from(hyper::header::AccessControlRequestMethod(
hyper::method::Method::Post,
));
let request_headers = hyper::header::AccessControlRequestHeaders(
vec![FromStr::from_str("Authorization").unwrap()],
);
let request_headers = Header::from(request_headers);
let req = client
.options("/")
.header(origin_header)
.header(method_header)
.header(request_headers);
let response = req.dispatch();
assert_eq!(response.status(), Status::Forbidden);
}
#[test]
fn cors_options_bad_request_header() {
let client = Client::new(rocket()).unwrap();
let origin_header = Header::from(
hyper::header::Origin::from_str("https://www.acme.com").unwrap(),
);
let method_header = Header::from(hyper::header::AccessControlRequestMethod(
hyper::method::Method::Get,
));
let request_headers =
hyper::header::AccessControlRequestHeaders(vec![FromStr::from_str("Foobar").unwrap()]);
let request_headers = Header::from(request_headers);
let req = client
.options("/")
.header(origin_header)
.header(method_header)
.header(request_headers);
let response = req.dispatch();
assert_eq!(response.status(), Status::Forbidden);
}
#[test]
fn cors_get_bad_origin() {
let client = Client::new(rocket()).unwrap();
let origin_header = Header::from(
hyper::header::Origin::from_str("https://www.bad-origin.com").unwrap(),
);
let authorization = Header::new("Authorization", "let me in");
let req = client.get("/").header(origin_header).header(authorization);
let response = req.dispatch();
assert_eq!(response.status(), Status::Forbidden);
}

View File

@ -9,7 +9,7 @@ use std::ops::Deref;
use std::str::FromStr; use std::str::FromStr;
use rocket::local::Client; use rocket::local::Client;
use rocket::http::{Header, Status}; use rocket::http::Header;
use rocket_cors::headers::*; use rocket_cors::headers::*;
#[get("/request_headers")] #[get("/request_headers")]
@ -52,7 +52,7 @@ fn request_headers_round_trip_smoke_test() {
.header(request_headers); .header(request_headers);
let mut response = req.dispatch(); let mut response = req.dispatch();
assert_eq!(Status::Ok, response.status()); assert!(response.status().class().is_success());
let body_str = response.body().and_then(|body| body.into_string()).expect( let body_str = response.body().and_then(|body| body.into_string()).expect(
"Non-empty body", "Non-empty body",
); );