forked from jooby-project/jooby
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathIssue1413.java
More file actions
125 lines (109 loc) · 5.02 KB
/
Copy pathIssue1413.java
File metadata and controls
125 lines (109 loc) · 5.02 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
package io.jooby;
import io.jooby.junit.ServerTest;
import io.jooby.junit.ServerTestRunner;
import static org.junit.jupiter.api.Assertions.assertEquals;
import static org.junit.jupiter.api.Assertions.assertNull;
public class Issue1413 {
@ServerTest
public void shouldDoPreflightWithCredentials(ServerTestRunner runner) {
runner.define(app -> {
app.decorator(new CorsHandler(new Cors()
.setMethods("*")
.setOrigin("http://foo.com")
.setUseCredentials(true)
));
app.put("/api/v1/machines/{key}", ctx -> ctx.path("key").value());
app.post("/api/v1/machines/{key}", ctx -> ctx.path("key").value());
app.get("/api/v1/machines/{key}", ctx -> ctx.path("key").value());
}).ready(client -> {
// OPTIONS (Pre-flight), checking PUT Method => OK and Access Control Headers Present
client
.header("Origin", "http://foo.com")
.header("Access-Control-Request-Method", "PUT")
.options("/api/v1/machines/123", rsp -> {
assertEquals("", rsp.body().string());
assertEquals(200, rsp.code());
assertEquals("http://foo.com", rsp.header("Access-Control-Allow-Origin"));
assertEquals("true", rsp.header("Access-Control-Allow-Credentials"));
});
// POST Method by allowed origin => OK and Access Control Headers Present
client
.header("Origin", "http://foo.com")
.post("/api/v1/machines/123", rsp -> {
assertEquals("123", rsp.body().string());
assertEquals(200, rsp.code());
assertEquals("http://foo.com", rsp.header("Access-Control-Allow-Origin"));
assertEquals("true", rsp.header("Access-Control-Allow-Credentials"));
});
// Origin different from the allowed one => Forbidden
client
.header("Origin", "http://bar.com")
.get("/api/v1/machines/123", rsp -> {
assertEquals(403, rsp.code());
assertEquals("", rsp.body().string());
assertNull(rsp.header("Access-Control-Allow-Origin"));
assertNull(rsp.header("Access-Control-Allow-Credentials"));
});
// PUT Method and allowed origin => OK and Access Control Headers Present
client
.header("Origin", "http://foo.com")
.put("/api/v1/machines/123", rsp -> {
assertEquals("123", rsp.body().string());
assertEquals(200, rsp.code());
assertEquals("http://foo.com", rsp.header("Access-Control-Allow-Origin"));
assertEquals("true", rsp.header("Access-Control-Allow-Credentials"));
});
});
}
@ServerTest
public void shouldDoPreflightWithoutCredentials(ServerTestRunner runner) {
runner.define(app -> {
app.decorator(new CorsHandler(new Cors()
.setMethods("*")
.setOrigin("http://foo.com")
.setUseCredentials(false)
));
app.put("/api/v1/machines/{key}", ctx -> ctx.path("key").value());
app.post("/api/v1/machines/{key}", ctx -> ctx.path("key").value());
app.get("/api/v1/machines/{key}", ctx -> ctx.path("key").value());
}).ready(client -> {
// OPTIONS (Pre-flight), checking PUT Method => OK and Access Control Headers Present
client
.header("Origin", "http://foo.com")
.header("Access-Control-Request-Method", "PUT")
.options("/api/v1/machines/123", rsp -> {
assertEquals("", rsp.body().string());
assertEquals(200, rsp.code());
assertEquals("http://foo.com", rsp.header("Access-Control-Allow-Origin"));
assertNull(rsp.header("Access-Control-Allow-Credentials"));
});
// POST Method by allowed origin => OK and Access Control Headers Present
client
.header("Origin", "http://foo.com")
.post("/api/v1/machines/123", rsp -> {
assertEquals("123", rsp.body().string());
assertEquals(200, rsp.code());
assertEquals("http://foo.com", rsp.header("Access-Control-Allow-Origin"));
assertNull(rsp.header("Access-Control-Allow-Credentials"));
});
// Origin different from the allowed one => Forbidden
client
.header("Origin", "http://bar.com")
.get("/api/v1/machines/123", rsp -> {
assertEquals(403, rsp.code());
assertEquals("", rsp.body().string());
assertNull(rsp.header("Access-Control-Allow-Origin"));
assertNull(rsp.header("Access-Control-Allow-Credentials"));
});
// PUT Method and allowed origin => OK and Access Control Headers Present
client
.header("Origin", "http://foo.com")
.put("/api/v1/machines/123", rsp -> {
assertEquals("123", rsp.body().string());
assertEquals(200, rsp.code());
assertEquals("http://foo.com", rsp.header("Access-Control-Allow-Origin"));
assertNull(rsp.header("Access-Control-Allow-Credentials"));
});
});
}
}