Merge pull request #37 from Progmasoft/fix/hsts-preload

Treat progmasoft.com as an HSTS-preloaded domain

1 files changed, 18 insertions, 0 deletions

diff --git a/apps/api-tests/SecurityHeaderTests.cs b/apps/api-tests/SecurityHeaderTests.cs
index 2d53ecf..e355035 100644
--- a/apps/api-tests/SecurityHeaderTests.cs
+++ b/apps/api-tests/SecurityHeaderTests.cs
@@ -4,6 +4,7 @@
 using System.Net;
 using Microsoft.AspNetCore.Builder;
 using Microsoft.AspNetCore.HttpOverrides;
+using Microsoft.AspNetCore.Mvc.Testing;
 using Progmasoft.Progmaweb.Api.Security;
 
 namespace Progmasoft.Progmaweb.Api.Tests;
@@ -41,4 +42,21 @@ public sealed class SecurityHeaderTests
         Assert.Contains("frame-ancestors 'none'",
             Assert.Single(response.Headers.GetValues("Content-Security-Policy")), StringComparison.Ordinal);
     }
+
+    [Fact]
+    public async Task HttpsResponsesCarryThePreloadPolicyNginxSends()
+    {
+        await using AccountApiFactory factory = new();
+        using HttpClient client = factory.CreateClient(new WebApplicationFactoryClientOptions
+        {
+            AllowAutoRedirect = false,
+            BaseAddress = new Uri("https://account.progmasoft.com"),
+        });
+
+        HttpResponseMessage response =
+            await client.GetAsync("/api/v1/status", TestContext.Current.CancellationToken);
+
+        Assert.Equal("max-age=63072000; includeSubDomains; preload",
+            Assert.Single(response.Headers.GetValues("Strict-Transport-Security")));
+    }
 }