28 lines
1.0 KiB
TypeScript
28 lines
1.0 KiB
TypeScript
import { describe, expect, test } from 'bun:test';
|
|
import { isCsrfProtectedRequest, isTrustedRequestOrigin } from './csrf';
|
|
|
|
describe('CSRF origin protection', () => {
|
|
test('allows safe methods without origin headers', () => {
|
|
const request = new Request('https://school.example/api/students');
|
|
expect(isCsrfProtectedRequest(request)).toBeFalse();
|
|
expect(isTrustedRequestOrigin(request)).toBeTrue();
|
|
});
|
|
|
|
test('allows mutations from the request origin', () => {
|
|
const request = new Request('https://school.example/api/students', {
|
|
method: 'POST',
|
|
headers: { origin: 'https://school.example' },
|
|
});
|
|
expect(isCsrfProtectedRequest(request)).toBeTrue();
|
|
expect(isTrustedRequestOrigin(request)).toBeTrue();
|
|
});
|
|
|
|
test('rejects cross-origin mutation requests', () => {
|
|
const request = new Request('https://school.example/api/students', {
|
|
method: 'DELETE',
|
|
headers: { origin: 'https://attacker.example' },
|
|
});
|
|
expect(isTrustedRequestOrigin(request)).toBeFalse();
|
|
});
|
|
});
|