34 lines
1.5 KiB
TypeScript
34 lines
1.5 KiB
TypeScript
import assert from 'node:assert/strict';
|
|
import { test } from 'node:test';
|
|
import { accessToken } from '../src/accounts/access-token.ts';
|
|
import { hasValidWebSocketOrigin } from '../src/http-security.ts';
|
|
|
|
test('Access JWT can fall back to the browser authorization cookie', async () => {
|
|
const request = new Request('https://edgessh.example.workers.dev/api/auth/me', {
|
|
headers: { Cookie: 'unrelated=value; CF_Authorization=not-a-jwt; another=value' },
|
|
});
|
|
assert.equal(accessToken(request), 'not-a-jwt');
|
|
});
|
|
|
|
test('missing Access header and cookie is reported as unauthenticated', async () => {
|
|
const request = new Request('https://edgessh.example.workers.dev/api/auth/me');
|
|
assert.equal(accessToken(request), null);
|
|
});
|
|
|
|
test('Access assertion header takes precedence over the browser cookie', async () => {
|
|
const request = new Request('https://edgessh.example.workers.dev/api/auth/me', {
|
|
headers: {
|
|
'Cf-Access-Jwt-Assertion': 'header-token',
|
|
Cookie: 'CF_Authorization=cookie-token',
|
|
},
|
|
});
|
|
assert.equal(accessToken(request), 'header-token');
|
|
});
|
|
|
|
test('WebSocket upgrades require an explicit same-origin browser header', () => {
|
|
const url = 'https://ssh.example.com/api/ssh';
|
|
assert.equal(hasValidWebSocketOrigin(new Request(url)), false);
|
|
assert.equal(hasValidWebSocketOrigin(new Request(url, { headers: { Origin: 'https://other.example.com' } })), false);
|
|
assert.equal(hasValidWebSocketOrigin(new Request(url, { headers: { Origin: 'https://ssh.example.com' } })), true);
|
|
});
|