50 lines
2.0 KiB
C#
50 lines
2.0 KiB
C#
namespace ItWorx.KnowledgeHub.Api.Tests;
|
|
|
|
public sealed class SecurityHeaderTests : IClassFixture<KnowledgeHubApiFactory>
|
|
{
|
|
private readonly HttpClient _client;
|
|
|
|
public SecurityHeaderTests(KnowledgeHubApiFactory factory)
|
|
{
|
|
_client = factory.CreateClient();
|
|
}
|
|
|
|
[Fact]
|
|
public async Task Responses_carry_the_documented_baseline_security_headers()
|
|
{
|
|
using var response = await _client.GetAsync("/health/live");
|
|
|
|
Assert.Equal("nosniff", GetHeader(response, "X-Content-Type-Options"));
|
|
Assert.Equal("DENY", GetHeader(response, "X-Frame-Options"));
|
|
Assert.Equal("same-origin", GetHeader(response, "Referrer-Policy"));
|
|
Assert.Contains("frame-ancestors 'none'", GetHeader(response, "Content-Security-Policy"));
|
|
Assert.Contains("object-src 'none'", GetHeader(response, "Content-Security-Policy"));
|
|
Assert.DoesNotContain("script-src 'self' 'unsafe-inline'", GetHeader(response, "Content-Security-Policy"));
|
|
Assert.NotNull(GetHeader(response, "Permissions-Policy"));
|
|
}
|
|
|
|
[Fact]
|
|
public async Task Every_response_carries_a_correlation_id_header()
|
|
{
|
|
using var response = await _client.GetAsync("/health/live");
|
|
|
|
var correlationId = GetHeader(response, "X-Correlation-ID");
|
|
Assert.False(string.IsNullOrWhiteSpace(correlationId));
|
|
Assert.True(Guid.TryParse(correlationId, out _));
|
|
}
|
|
|
|
[Fact]
|
|
public async Task A_supplied_correlation_id_is_echoed_back_unchanged()
|
|
{
|
|
using var request = new HttpRequestMessage(HttpMethod.Get, "/health/live");
|
|
request.Headers.Add("X-Correlation-ID", "caller-supplied-id-123");
|
|
|
|
using var response = await _client.SendAsync(request);
|
|
|
|
Assert.Equal("caller-supplied-id-123", GetHeader(response, "X-Correlation-ID"));
|
|
}
|
|
|
|
private static string? GetHeader(HttpResponseMessage response, string name) =>
|
|
response.Headers.TryGetValues(name, out var values) ? string.Join(", ", values) : null;
|
|
}
|