38 lines
1.3 KiB
JavaScript
38 lines
1.3 KiB
JavaScript
const {
|
|
isAllowedCorsOrigin,
|
|
isPrivateLanHostname,
|
|
parseAllowedOrigins,
|
|
} = require("../utils/cors-origins");
|
|
|
|
describe("CORS origin helpers", () => {
|
|
test("parses configured allowed origins", () => {
|
|
expect(parseAllowedOrigins(" http://localhost:3010, http://127.0.0.1:3010 ,,")).toEqual([
|
|
"http://localhost:3010",
|
|
"http://127.0.0.1:3010",
|
|
]);
|
|
});
|
|
|
|
test("allows exact configured origins", () => {
|
|
const allowedOrigins = ["http://localhost:3010"];
|
|
|
|
expect(isAllowedCorsOrigin("http://localhost:3010", allowedOrigins)).toBe(true);
|
|
});
|
|
|
|
test("allows browser access from the local private network", () => {
|
|
expect(isAllowedCorsOrigin("http://192.168.7.45:3010", [])).toBe(true);
|
|
});
|
|
|
|
test("recognizes RFC1918 private IPv4 hostnames", () => {
|
|
expect(isPrivateLanHostname("10.1.2.3")).toBe(true);
|
|
expect(isPrivateLanHostname("172.16.0.1")).toBe(true);
|
|
expect(isPrivateLanHostname("172.31.255.254")).toBe(true);
|
|
expect(isPrivateLanHostname("192.168.7.45")).toBe(true);
|
|
});
|
|
|
|
test("rejects public and lookalike hostnames", () => {
|
|
expect(isAllowedCorsOrigin("http://192.168.7.45.example.test:3010", [])).toBe(false);
|
|
expect(isAllowedCorsOrigin("http://203.0.113.10:3010", [])).toBe(false);
|
|
expect(isAllowedCorsOrigin("ftp://192.168.7.45:3010", [])).toBe(false);
|
|
});
|
|
});
|