43 lines
1.3 KiB
Haskell
43 lines
1.3 KiB
Haskell
{-# LANGUAGE OverloadedStrings #-}
|
|
|
|
module Feature.CorsSpec where
|
|
|
|
-- {{{ Imports
|
|
import Test.Hspec
|
|
import Test.Hspec.Wai
|
|
import Network.Wai.Test (SResponse(simpleHeaders))
|
|
|
|
import SpecHelper
|
|
|
|
import Network.HTTP.Types
|
|
-- }}}
|
|
|
|
spec :: Spec
|
|
spec = around appWithFixture $
|
|
describe "CORS" $
|
|
it "replies naively and permissively to preflight request" $ do
|
|
r <- request methodOptions "/"
|
|
[
|
|
("Accept", "*/*")
|
|
, ("Origin", "http://example.com")
|
|
, ("Access-Control-Request-Method", "POST")
|
|
, ("Access-Control-Request-Headers", "Foo,Bar")
|
|
] ""
|
|
liftIO $ do
|
|
let respHeaders = simpleHeaders r
|
|
respHeaders `shouldSatisfy` matchHeader
|
|
"Access-Control-Allow-Origin"
|
|
"http://example.com"
|
|
respHeaders `shouldSatisfy` matchHeader
|
|
"Access-Control-Allow-Credentials"
|
|
"true"
|
|
respHeaders `shouldSatisfy` matchHeader
|
|
"Access-Control-Allow-Methods"
|
|
"GET, POST, PUT, PATCH, DELETE, OPTIONS, HEAD"
|
|
respHeaders `shouldSatisfy` matchHeader
|
|
"Access-Control-Allow-Headers"
|
|
"Authentication, Foo, Bar, Accept, Accept-Language, Content-Language"
|
|
respHeaders `shouldSatisfy` matchHeader
|
|
"Access-Control-Max-Age"
|
|
"86400"
|