|
|
|
|
@ -51,13 +51,15 @@ public class HeaderBuilderTests {
@@ -51,13 +51,15 @@ public class HeaderBuilderTests {
|
|
|
|
|
|
|
|
|
|
@Before |
|
|
|
|
public void setup() { |
|
|
|
|
expectedHeaders.add(StrictTransportSecurityHttpHeadersWriter.STRICT_TRANSPORT_SECURITY, "max-age=31536000 ; includeSubDomains"); |
|
|
|
|
expectedHeaders.add(HttpHeaders.CACHE_CONTROL, "no-cache, no-store, max-age=0, must-revalidate"); |
|
|
|
|
expectedHeaders.add(HttpHeaders.PRAGMA, "no-cache"); |
|
|
|
|
expectedHeaders.add(HttpHeaders.EXPIRES, "0"); |
|
|
|
|
expectedHeaders.add(ContentTypeOptionsHttpHeadersWriter.X_CONTENT_OPTIONS, "nosniff"); |
|
|
|
|
expectedHeaders.add(XFrameOptionsHttpHeadersWriter.X_FRAME_OPTIONS, "DENY"); |
|
|
|
|
expectedHeaders.add(XXssProtectionHttpHeadersWriter.X_XSS_PROTECTION, "1 ; mode=block"); |
|
|
|
|
this.expectedHeaders.add(StrictTransportSecurityHttpHeadersWriter.STRICT_TRANSPORT_SECURITY, "max-age=31536000 ; includeSubDomains"); |
|
|
|
|
this.expectedHeaders.add(HttpHeaders.CACHE_CONTROL, "no-cache, no-store, max-age=0, must-revalidate"); |
|
|
|
|
this.expectedHeaders.add(HttpHeaders.PRAGMA, "no-cache"); |
|
|
|
|
this.expectedHeaders.add(HttpHeaders.EXPIRES, "0"); |
|
|
|
|
this.expectedHeaders |
|
|
|
|
.add(ContentTypeOptionsHttpHeadersWriter.X_CONTENT_OPTIONS, "nosniff"); |
|
|
|
|
this.expectedHeaders.add(XFrameOptionsHttpHeadersWriter.X_FRAME_OPTIONS, "DENY"); |
|
|
|
|
this.expectedHeaders |
|
|
|
|
.add(XXssProtectionHttpHeadersWriter.X_XSS_PROTECTION, "1 ; mode=block"); |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
@Test |
|
|
|
|
@ -67,61 +69,62 @@ public class HeaderBuilderTests {
@@ -67,61 +69,62 @@ public class HeaderBuilderTests {
|
|
|
|
|
|
|
|
|
|
@Test |
|
|
|
|
public void headersWhenCacheDisableThenCacheNotWritten() { |
|
|
|
|
expectedHeaders.remove(HttpHeaders.CACHE_CONTROL); |
|
|
|
|
expectedHeaders.remove(HttpHeaders.PRAGMA); |
|
|
|
|
expectedHeaders.remove(HttpHeaders.EXPIRES); |
|
|
|
|
headers.cache().disable(); |
|
|
|
|
this.expectedHeaders.remove(HttpHeaders.CACHE_CONTROL); |
|
|
|
|
this.expectedHeaders.remove(HttpHeaders.PRAGMA); |
|
|
|
|
this.expectedHeaders.remove(HttpHeaders.EXPIRES); |
|
|
|
|
this.headers.cache().disable(); |
|
|
|
|
|
|
|
|
|
assertHeaders(); |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
@Test |
|
|
|
|
public void headersWhenContentOptionsDisableThenContentTypeOptionsNotWritten() { |
|
|
|
|
expectedHeaders.remove(ContentTypeOptionsHttpHeadersWriter.X_CONTENT_OPTIONS); |
|
|
|
|
headers.contentTypeOptions().disable(); |
|
|
|
|
this.expectedHeaders.remove(ContentTypeOptionsHttpHeadersWriter.X_CONTENT_OPTIONS); |
|
|
|
|
this.headers.contentTypeOptions().disable(); |
|
|
|
|
|
|
|
|
|
assertHeaders(); |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
@Test |
|
|
|
|
public void headersWhenHstsDisableThenHstsNotWritten() { |
|
|
|
|
expectedHeaders.remove(StrictTransportSecurityHttpHeadersWriter.STRICT_TRANSPORT_SECURITY); |
|
|
|
|
headers.hsts().disable(); |
|
|
|
|
this.expectedHeaders.remove(StrictTransportSecurityHttpHeadersWriter.STRICT_TRANSPORT_SECURITY); |
|
|
|
|
this.headers.hsts().disable(); |
|
|
|
|
|
|
|
|
|
assertHeaders(); |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
@Test |
|
|
|
|
public void headersWhenHstsCustomThenCustomHstsWritten() { |
|
|
|
|
expectedHeaders.remove(StrictTransportSecurityHttpHeadersWriter.STRICT_TRANSPORT_SECURITY); |
|
|
|
|
expectedHeaders.add(StrictTransportSecurityHttpHeadersWriter.STRICT_TRANSPORT_SECURITY, "max-age=60"); |
|
|
|
|
headers.hsts().maxAge(Duration.ofSeconds(60)); |
|
|
|
|
headers.hsts().includeSubdomains(false); |
|
|
|
|
this.expectedHeaders.remove(StrictTransportSecurityHttpHeadersWriter.STRICT_TRANSPORT_SECURITY); |
|
|
|
|
this.expectedHeaders.add(StrictTransportSecurityHttpHeadersWriter.STRICT_TRANSPORT_SECURITY, "max-age=60"); |
|
|
|
|
this.headers.hsts().maxAge(Duration.ofSeconds(60)); |
|
|
|
|
this.headers.hsts().includeSubdomains(false); |
|
|
|
|
|
|
|
|
|
assertHeaders(); |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
@Test |
|
|
|
|
public void headersWhenFrameOptionsDisableThenFrameOptionsNotWritten() { |
|
|
|
|
expectedHeaders.remove(XFrameOptionsHttpHeadersWriter.X_FRAME_OPTIONS); |
|
|
|
|
headers.frameOptions().disable(); |
|
|
|
|
this.expectedHeaders.remove(XFrameOptionsHttpHeadersWriter.X_FRAME_OPTIONS); |
|
|
|
|
this.headers.frameOptions().disable(); |
|
|
|
|
|
|
|
|
|
assertHeaders(); |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
@Test |
|
|
|
|
public void headersWhenFrameOptionsModeThenFrameOptionsCustomMode() { |
|
|
|
|
expectedHeaders.remove(XFrameOptionsHttpHeadersWriter.X_FRAME_OPTIONS); |
|
|
|
|
expectedHeaders.add(XFrameOptionsHttpHeadersWriter.X_FRAME_OPTIONS, "SAMEORIGIN"); |
|
|
|
|
headers.frameOptions().mode(XFrameOptionsHttpHeadersWriter.Mode.SAMEORIGIN); |
|
|
|
|
this.expectedHeaders.remove(XFrameOptionsHttpHeadersWriter.X_FRAME_OPTIONS); |
|
|
|
|
this.expectedHeaders |
|
|
|
|
.add(XFrameOptionsHttpHeadersWriter.X_FRAME_OPTIONS, "SAMEORIGIN"); |
|
|
|
|
this.headers.frameOptions().mode(XFrameOptionsHttpHeadersWriter.Mode.SAMEORIGIN); |
|
|
|
|
|
|
|
|
|
assertHeaders(); |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
@Test |
|
|
|
|
public void headersWhenXssProtectionDisableThenXssProtectionNotWritten() { |
|
|
|
|
expectedHeaders.remove("X-Xss-Protection"); |
|
|
|
|
headers.xssProtection().disable(); |
|
|
|
|
this.expectedHeaders.remove("X-Xss-Protection"); |
|
|
|
|
this.headers.xssProtection().disable(); |
|
|
|
|
|
|
|
|
|
assertHeaders(); |
|
|
|
|
} |
|
|
|
|
@ -134,12 +137,13 @@ public class HeaderBuilderTests {
@@ -134,12 +137,13 @@ public class HeaderBuilderTests {
|
|
|
|
|
.returnResult(String.class); |
|
|
|
|
|
|
|
|
|
Map<String,List<String>> responseHeaders = response.getResponseHeaders(); |
|
|
|
|
ignoredHeaderNames.stream().forEach(responseHeaders::remove); |
|
|
|
|
this.ignoredHeaderNames.stream().forEach(responseHeaders::remove); |
|
|
|
|
|
|
|
|
|
assertThat(responseHeaders).describedAs(response.toString()).isEqualTo(expectedHeaders); |
|
|
|
|
assertThat(responseHeaders).describedAs(response.toString()).isEqualTo( |
|
|
|
|
this.expectedHeaders); |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
private WebTestClient buildClient() { |
|
|
|
|
return WebTestClientBuilder.bindToWebFilters(headers.build()).build(); |
|
|
|
|
return WebTestClientBuilder.bindToWebFilters(this.headers.build()).build(); |
|
|
|
|
} |
|
|
|
|
} |
|
|
|
|
|