1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
|
// SPDX-FileCopyrightText: 2026 Progmasoft <support@progmasoft.com>
// SPDX-License-Identifier: AGPL-3.0-or-later WITH AdditionRef-Progmasoft-Patent-Grant-1.1
using System.Net;
using Microsoft.AspNetCore.Builder;
using Microsoft.AspNetCore.HttpOverrides;
using Microsoft.AspNetCore.Mvc.Testing;
using Progmasoft.Progmaweb.Api.Security;
namespace Progmasoft.Progmaweb.Api.Tests;
public sealed class SecurityHeaderTests
{
[Fact]
public void ForwardedHeadersTrustOnlyTheLocalReverseProxy()
{
ForwardedHeadersOptions options = new();
ForwardedHeadersPolicy.Configure(options);
Assert.Equal(ForwardedHeadersPolicy.MaximumForwardedHops, options.ForwardLimit);
Assert.Equal(ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedHost |
ForwardedHeaders.XForwardedProto, options.ForwardedHeaders);
Assert.Equal(ForwardedHeadersPolicy.TrustedProxies, options.KnownProxies);
Assert.Empty(options.KnownIPNetworks);
}
[Fact]
public async Task ApiResponsesSetDefensiveHeaders()
{
await using AccountApiFactory factory = new();
using HttpClient client = factory.CreateAccountClient(handleCookies: false);
HttpResponseMessage response =
await client.GetAsync("/api/v1/status", TestContext.Current.CancellationToken);
Assert.Equal(HttpStatusCode.OK, response.StatusCode);
Assert.Equal("no-store", Assert.Single(response.Headers.GetValues("Cache-Control")));
Assert.Equal("no-referrer", Assert.Single(response.Headers.GetValues("Referrer-Policy")));
Assert.Equal("nosniff", Assert.Single(response.Headers.GetValues("X-Content-Type-Options")));
Assert.Equal("DENY", Assert.Single(response.Headers.GetValues("X-Frame-Options")));
Assert.Contains("frame-ancestors 'none'",
Assert.Single(response.Headers.GetValues("Content-Security-Policy")), StringComparison.Ordinal);
}
[Fact]
public async Task HttpsResponsesCarryThePreloadPolicyNginxSends()
{
await using AccountApiFactory factory = new();
using HttpClient client = factory.CreateClient(new WebApplicationFactoryClientOptions
{
AllowAutoRedirect = false,
BaseAddress = new Uri("https://account.progmasoft.com"),
});
HttpResponseMessage response =
await client.GetAsync("/api/v1/status", TestContext.Current.CancellationToken);
Assert.Equal("max-age=63072000; includeSubDomains; preload",
Assert.Single(response.Headers.GetValues("Strict-Transport-Security")));
}
}
|