Dmitry VerkhoturovandUmputun
f7dbdae26c
Pure relocation, no behaviour change: gather all request-scoped middlewares
and their tests into dedicated files instead of scattering them across
rest.go and ssl.go.
funcs -> app/rest/api/middleware.go:
timeout (from ssl.go); rejectAnonUser, matchSiteID, cacheControl,
apiCSPMiddleware, securityHeadersMiddleware, subscribersOnly,
validEmailAuth, rateLimiter (from rest.go)
tests -> app/rest/api/middleware_test.go:
TestTimeout (from ssl_test.go); TestRest_rejectAnonUser,
TestRest_cacheControl, TestRest_apiCSP, TestRest_securityHeaders,
TestRest_subscribersOnly, Test_validEmailAuth, TestRest_matchSiteID
(from rest_test.go)
go test -race, vet, golangci-lint and govulncheck clean; example builds.
102 lines
2.8 KiB
Go
102 lines
2.8 KiB
Go
package api
|
|
|
|
import (
|
|
"context"
|
|
"crypto/tls"
|
|
"io"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"os"
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func TestSSL_Redirect(t *testing.T) {
|
|
rest := Rest{RemarkURL: "https://localhost:443"}
|
|
|
|
ts := httptest.NewServer(rest.httpToHTTPSRouter())
|
|
defer ts.Close()
|
|
|
|
client := http.Client{
|
|
// prevent http redirect
|
|
CheckRedirect: func(*http.Request, []*http.Request) error {
|
|
return http.ErrUseLastResponse
|
|
},
|
|
|
|
// allow self-signed certificate
|
|
Transport: &http.Transport{
|
|
TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
|
|
},
|
|
}
|
|
defer client.CloseIdleConnections()
|
|
|
|
// check http to https redirect response
|
|
resp, err := client.Get(ts.URL + "/blah?param=1")
|
|
require.NoError(t, err)
|
|
defer resp.Body.Close()
|
|
assert.Equal(t, http.StatusTemporaryRedirect, resp.StatusCode)
|
|
assert.Equal(t, "https://localhost:443/blah?param=1", resp.Header.Get("Location"))
|
|
}
|
|
|
|
func TestSSL_RedirectURLKeepsConfiguredHost(t *testing.T) {
|
|
rest := Rest{RemarkURL: "https://localhost:443/base"}
|
|
req, err := http.NewRequest("GET", "http://example.com//evil.test/path?next=//evil.test", http.NoBody)
|
|
require.NoError(t, err)
|
|
|
|
redirectURL, err := rest.redirectURL(req)
|
|
require.NoError(t, err)
|
|
assert.Equal(t, "https://localhost:443/base/evil.test/path?next=//evil.test", redirectURL)
|
|
}
|
|
|
|
func TestSSL_ACME_HTTPChallengeRouter(t *testing.T) {
|
|
rest := Rest{
|
|
RemarkURL: "https://localhost:443",
|
|
SSLConfig: SSLConfig{
|
|
ACMELocation: "acme",
|
|
},
|
|
}
|
|
|
|
m := rest.makeAutocertManager()
|
|
defer os.RemoveAll(rest.SSLConfig.ACMELocation)
|
|
|
|
ts := httptest.NewServer(rest.httpChallengeRouter(m))
|
|
defer ts.Close()
|
|
|
|
client := http.Client{
|
|
// prevent http redirect
|
|
CheckRedirect: func(*http.Request, []*http.Request) error {
|
|
return http.ErrUseLastResponse
|
|
},
|
|
}
|
|
defer client.CloseIdleConnections()
|
|
|
|
// check http to https redirect response
|
|
resp, err := client.Get(ts.URL + "/blah?param=1")
|
|
require.NoError(t, err)
|
|
defer resp.Body.Close()
|
|
assert.Equal(t, http.StatusTemporaryRedirect, resp.StatusCode)
|
|
assert.Equal(t, "https://localhost:443/blah?param=1", resp.Header.Get("Location"))
|
|
|
|
// check acme http challenge
|
|
req, err := http.NewRequest("GET", ts.URL+"/.well-known/acme-challenge/token123", http.NoBody)
|
|
require.NoError(t, err)
|
|
req.Host = "localhost" // for passing hostPolicy check
|
|
resp, err = client.Do(req)
|
|
require.NoError(t, err)
|
|
defer resp.Body.Close()
|
|
assert.Equal(t, http.StatusNotFound, resp.StatusCode)
|
|
|
|
err = m.Cache.Put(context.Background(), "token123+http-01", []byte("token"))
|
|
assert.NoError(t, err)
|
|
|
|
resp, err = client.Do(req)
|
|
require.NoError(t, err)
|
|
defer resp.Body.Close()
|
|
assert.Equal(t, http.StatusOK, resp.StatusCode)
|
|
body, err := io.ReadAll(resp.Body)
|
|
require.NoError(t, err)
|
|
assert.Equal(t, "token", string(body))
|
|
}
|