dbledeez
4ccccc6fe2
Self-hostable game server control panel: Go controller + agent, 26 game modules, embedded web UI. One-line install via install.sh / install.ps1. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
65 lines
2.0 KiB
Go
65 lines
2.0 KiB
Go
package main
|
|
|
|
import (
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"testing"
|
|
)
|
|
|
|
func TestSameOriginHost(t *testing.T) {
|
|
cases := []struct {
|
|
origin, host string
|
|
want bool
|
|
}{
|
|
{"https://panel.example.com", "panel.example.com", true},
|
|
{"http://panel.example.com:8080", "panel.example.com:8080", true},
|
|
{"https://PANEL.example.com", "panel.example.com", true},
|
|
{"https://evil.com", "panel.example.com", false},
|
|
{"https://panel.example.com.evil.com", "panel.example.com", false},
|
|
{"null", "panel.example.com", false},
|
|
{"", "panel.example.com", false},
|
|
}
|
|
for _, c := range cases {
|
|
if got := sameOriginHost(c.origin, c.host); got != c.want {
|
|
t.Errorf("sameOriginHost(%q, %q) = %v, want %v", c.origin, c.host, got, c.want)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestWithCORSReflection(t *testing.T) {
|
|
h := withCORS(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
w.WriteHeader(http.StatusOK)
|
|
}))
|
|
|
|
// Same-origin browser request: origin reflected.
|
|
r := httptest.NewRequest("GET", "http://panel.local/api/agents", nil)
|
|
r.Host = "panel.local"
|
|
r.Header.Set("Origin", "https://panel.local")
|
|
w := httptest.NewRecorder()
|
|
h.ServeHTTP(w, r)
|
|
if got := w.Header().Get("Access-Control-Allow-Origin"); got != "https://panel.local" {
|
|
t.Errorf("same-origin ACAO = %q, want reflected origin", got)
|
|
}
|
|
|
|
// Cross-origin: no ACAO header at all.
|
|
r = httptest.NewRequest("GET", "http://panel.local/api/agents", nil)
|
|
r.Host = "panel.local"
|
|
r.Header.Set("Origin", "https://evil.com")
|
|
w = httptest.NewRecorder()
|
|
h.ServeHTTP(w, r)
|
|
if got := w.Header().Get("Access-Control-Allow-Origin"); got != "" {
|
|
t.Errorf("cross-origin ACAO = %q, want empty", got)
|
|
}
|
|
|
|
// No Origin (curl/panelctl): no ACAO, request still passes through.
|
|
r = httptest.NewRequest("OPTIONS", "http://panel.local/api/agents", nil)
|
|
w = httptest.NewRecorder()
|
|
h.ServeHTTP(w, r)
|
|
if w.Code != http.StatusNoContent {
|
|
t.Errorf("OPTIONS status = %d, want 204", w.Code)
|
|
}
|
|
if got := w.Header().Get("Cache-Control"); got == "" {
|
|
t.Error("Cache-Control no-store stamp missing")
|
|
}
|
|
}
|