24 lines
918 B
TypeScript
24 lines
918 B
TypeScript
import { describe, expect, it } from "vitest";
|
|
|
|
import { CSP_NONCE_REQUEST_HEADER } from "../apps/web/app/utils/security/contentSecurityPolicy";
|
|
import { createRequestCspNonce, overwriteRequestCspNonce } from "./csp";
|
|
|
|
describe("request CSP nonce", () => {
|
|
it("creates a cryptographically random nonce for every request", () => {
|
|
const nonces = new Set(Array.from({ length: 64 }, () => createRequestCspNonce()));
|
|
|
|
expect(nonces.size).toBe(64);
|
|
for (const nonce of nonces) {
|
|
expect(nonce).toMatch(/^[A-Za-z0-9_-]{24}$/u);
|
|
}
|
|
});
|
|
|
|
it("overwrites a spoofed incoming internal header", () => {
|
|
const headers = new Headers({ [CSP_NONCE_REQUEST_HEADER]: "attacker-controlled" });
|
|
const trustedNonce = "aBcDeFgHiJkLmNoPqRsTuVwX";
|
|
|
|
expect(overwriteRequestCspNonce(headers, trustedNonce)).toBe(trustedNonce);
|
|
expect(headers.get(CSP_NONCE_REQUEST_HEADER)).toBe(trustedNonce);
|
|
});
|
|
});
|