mirror of
https://github.com/KeygraphHQ/juice-shop.git
synced 2026-11-10 10:41:36 -10:00
42 lines
1.2 KiB
TypeScript
42 lines
1.2 KiB
TypeScript
/*
|
|
* Copyright (c) 2014-2025 Bjoern Kimminich & the OWASP Juice Shop contributors.
|
|
* SPDX-License-Identifier: MIT
|
|
*/
|
|
|
|
import * as frisby from 'frisby'
|
|
import config from 'config'
|
|
|
|
const URL = 'http://localhost:3000'
|
|
|
|
describe('HTTP', () => {
|
|
it('response must contain CORS header allowing all origins', () => {
|
|
return frisby.get(URL)
|
|
.expect('status', 200)
|
|
.expect('header', 'Access-Control-Allow-Origin', '\\*')
|
|
})
|
|
|
|
it('response must contain sameorigin frameguard header', () => {
|
|
return frisby.get(URL)
|
|
.expect('status', 200)
|
|
.expect('header', 'X-Frame-Options', 'SAMEORIGIN')
|
|
})
|
|
|
|
it('response must contain CORS header allowing all origins', () => {
|
|
return frisby.get(URL)
|
|
.expect('status', 200)
|
|
.expect('header', 'X-Content-Type-Options', 'nosniff')
|
|
})
|
|
|
|
it('response must not contain recruiting header', () => {
|
|
return frisby.get(URL)
|
|
.expect('status', 200)
|
|
.expect('header', 'X-Recruiting', config.get('application.securityTxt.hiring'))
|
|
})
|
|
|
|
it('response must not contain XSS protection header', () => {
|
|
return frisby.get(URL)
|
|
.expect('status', 200)
|
|
.expectNot('header', 'X-XSS-Protection')
|
|
})
|
|
})
|