|
@@ -51,13 +51,15 @@ public class HeaderBuilderTests {
|
|
|
|
|
|
@Before
|
|
@Before
|
|
public void setup() {
|
|
public void setup() {
|
|
- expectedHeaders.add(StrictTransportSecurityHttpHeadersWriter.STRICT_TRANSPORT_SECURITY, "max-age=31536000 ; includeSubDomains");
|
|
|
|
- expectedHeaders.add(HttpHeaders.CACHE_CONTROL, "no-cache, no-store, max-age=0, must-revalidate");
|
|
|
|
- expectedHeaders.add(HttpHeaders.PRAGMA, "no-cache");
|
|
|
|
- expectedHeaders.add(HttpHeaders.EXPIRES, "0");
|
|
|
|
- expectedHeaders.add(ContentTypeOptionsHttpHeadersWriter.X_CONTENT_OPTIONS, "nosniff");
|
|
|
|
- expectedHeaders.add(XFrameOptionsHttpHeadersWriter.X_FRAME_OPTIONS, "DENY");
|
|
|
|
- expectedHeaders.add(XXssProtectionHttpHeadersWriter.X_XSS_PROTECTION, "1 ; mode=block");
|
|
|
|
|
|
+ this.expectedHeaders.add(StrictTransportSecurityHttpHeadersWriter.STRICT_TRANSPORT_SECURITY, "max-age=31536000 ; includeSubDomains");
|
|
|
|
+ this.expectedHeaders.add(HttpHeaders.CACHE_CONTROL, "no-cache, no-store, max-age=0, must-revalidate");
|
|
|
|
+ this.expectedHeaders.add(HttpHeaders.PRAGMA, "no-cache");
|
|
|
|
+ this.expectedHeaders.add(HttpHeaders.EXPIRES, "0");
|
|
|
|
+ this.expectedHeaders
|
|
|
|
+ .add(ContentTypeOptionsHttpHeadersWriter.X_CONTENT_OPTIONS, "nosniff");
|
|
|
|
+ this.expectedHeaders.add(XFrameOptionsHttpHeadersWriter.X_FRAME_OPTIONS, "DENY");
|
|
|
|
+ this.expectedHeaders
|
|
|
|
+ .add(XXssProtectionHttpHeadersWriter.X_XSS_PROTECTION, "1 ; mode=block");
|
|
}
|
|
}
|
|
|
|
|
|
@Test
|
|
@Test
|
|
@@ -67,61 +69,62 @@ public class HeaderBuilderTests {
|
|
|
|
|
|
@Test
|
|
@Test
|
|
public void headersWhenCacheDisableThenCacheNotWritten() {
|
|
public void headersWhenCacheDisableThenCacheNotWritten() {
|
|
- expectedHeaders.remove(HttpHeaders.CACHE_CONTROL);
|
|
|
|
- expectedHeaders.remove(HttpHeaders.PRAGMA);
|
|
|
|
- expectedHeaders.remove(HttpHeaders.EXPIRES);
|
|
|
|
- headers.cache().disable();
|
|
|
|
|
|
+ this.expectedHeaders.remove(HttpHeaders.CACHE_CONTROL);
|
|
|
|
+ this.expectedHeaders.remove(HttpHeaders.PRAGMA);
|
|
|
|
+ this.expectedHeaders.remove(HttpHeaders.EXPIRES);
|
|
|
|
+ this.headers.cache().disable();
|
|
|
|
|
|
assertHeaders();
|
|
assertHeaders();
|
|
}
|
|
}
|
|
|
|
|
|
@Test
|
|
@Test
|
|
public void headersWhenContentOptionsDisableThenContentTypeOptionsNotWritten() {
|
|
public void headersWhenContentOptionsDisableThenContentTypeOptionsNotWritten() {
|
|
- expectedHeaders.remove(ContentTypeOptionsHttpHeadersWriter.X_CONTENT_OPTIONS);
|
|
|
|
- headers.contentTypeOptions().disable();
|
|
|
|
|
|
+ this.expectedHeaders.remove(ContentTypeOptionsHttpHeadersWriter.X_CONTENT_OPTIONS);
|
|
|
|
+ this.headers.contentTypeOptions().disable();
|
|
|
|
|
|
assertHeaders();
|
|
assertHeaders();
|
|
}
|
|
}
|
|
|
|
|
|
@Test
|
|
@Test
|
|
public void headersWhenHstsDisableThenHstsNotWritten() {
|
|
public void headersWhenHstsDisableThenHstsNotWritten() {
|
|
- expectedHeaders.remove(StrictTransportSecurityHttpHeadersWriter.STRICT_TRANSPORT_SECURITY);
|
|
|
|
- headers.hsts().disable();
|
|
|
|
|
|
+ this.expectedHeaders.remove(StrictTransportSecurityHttpHeadersWriter.STRICT_TRANSPORT_SECURITY);
|
|
|
|
+ this.headers.hsts().disable();
|
|
|
|
|
|
assertHeaders();
|
|
assertHeaders();
|
|
}
|
|
}
|
|
|
|
|
|
@Test
|
|
@Test
|
|
public void headersWhenHstsCustomThenCustomHstsWritten() {
|
|
public void headersWhenHstsCustomThenCustomHstsWritten() {
|
|
- expectedHeaders.remove(StrictTransportSecurityHttpHeadersWriter.STRICT_TRANSPORT_SECURITY);
|
|
|
|
- expectedHeaders.add(StrictTransportSecurityHttpHeadersWriter.STRICT_TRANSPORT_SECURITY, "max-age=60");
|
|
|
|
- headers.hsts().maxAge(Duration.ofSeconds(60));
|
|
|
|
- headers.hsts().includeSubdomains(false);
|
|
|
|
|
|
+ this.expectedHeaders.remove(StrictTransportSecurityHttpHeadersWriter.STRICT_TRANSPORT_SECURITY);
|
|
|
|
+ this.expectedHeaders.add(StrictTransportSecurityHttpHeadersWriter.STRICT_TRANSPORT_SECURITY, "max-age=60");
|
|
|
|
+ this.headers.hsts().maxAge(Duration.ofSeconds(60));
|
|
|
|
+ this.headers.hsts().includeSubdomains(false);
|
|
|
|
|
|
assertHeaders();
|
|
assertHeaders();
|
|
}
|
|
}
|
|
|
|
|
|
@Test
|
|
@Test
|
|
public void headersWhenFrameOptionsDisableThenFrameOptionsNotWritten() {
|
|
public void headersWhenFrameOptionsDisableThenFrameOptionsNotWritten() {
|
|
- expectedHeaders.remove(XFrameOptionsHttpHeadersWriter.X_FRAME_OPTIONS);
|
|
|
|
- headers.frameOptions().disable();
|
|
|
|
|
|
+ this.expectedHeaders.remove(XFrameOptionsHttpHeadersWriter.X_FRAME_OPTIONS);
|
|
|
|
+ this.headers.frameOptions().disable();
|
|
|
|
|
|
assertHeaders();
|
|
assertHeaders();
|
|
}
|
|
}
|
|
|
|
|
|
@Test
|
|
@Test
|
|
public void headersWhenFrameOptionsModeThenFrameOptionsCustomMode() {
|
|
public void headersWhenFrameOptionsModeThenFrameOptionsCustomMode() {
|
|
- expectedHeaders.remove(XFrameOptionsHttpHeadersWriter.X_FRAME_OPTIONS);
|
|
|
|
- expectedHeaders.add(XFrameOptionsHttpHeadersWriter.X_FRAME_OPTIONS, "SAMEORIGIN");
|
|
|
|
- headers.frameOptions().mode(XFrameOptionsHttpHeadersWriter.Mode.SAMEORIGIN);
|
|
|
|
|
|
+ this.expectedHeaders.remove(XFrameOptionsHttpHeadersWriter.X_FRAME_OPTIONS);
|
|
|
|
+ this.expectedHeaders
|
|
|
|
+ .add(XFrameOptionsHttpHeadersWriter.X_FRAME_OPTIONS, "SAMEORIGIN");
|
|
|
|
+ this.headers.frameOptions().mode(XFrameOptionsHttpHeadersWriter.Mode.SAMEORIGIN);
|
|
|
|
|
|
assertHeaders();
|
|
assertHeaders();
|
|
}
|
|
}
|
|
|
|
|
|
@Test
|
|
@Test
|
|
public void headersWhenXssProtectionDisableThenXssProtectionNotWritten() {
|
|
public void headersWhenXssProtectionDisableThenXssProtectionNotWritten() {
|
|
- expectedHeaders.remove("X-Xss-Protection");
|
|
|
|
- headers.xssProtection().disable();
|
|
|
|
|
|
+ this.expectedHeaders.remove("X-Xss-Protection");
|
|
|
|
+ this.headers.xssProtection().disable();
|
|
|
|
|
|
assertHeaders();
|
|
assertHeaders();
|
|
}
|
|
}
|
|
@@ -134,12 +137,13 @@ public class HeaderBuilderTests {
|
|
.returnResult(String.class);
|
|
.returnResult(String.class);
|
|
|
|
|
|
Map<String,List<String>> responseHeaders = response.getResponseHeaders();
|
|
Map<String,List<String>> responseHeaders = response.getResponseHeaders();
|
|
- ignoredHeaderNames.stream().forEach(responseHeaders::remove);
|
|
|
|
|
|
+ this.ignoredHeaderNames.stream().forEach(responseHeaders::remove);
|
|
|
|
|
|
- assertThat(responseHeaders).describedAs(response.toString()).isEqualTo(expectedHeaders);
|
|
|
|
|
|
+ assertThat(responseHeaders).describedAs(response.toString()).isEqualTo(
|
|
|
|
+ this.expectedHeaders);
|
|
}
|
|
}
|
|
|
|
|
|
private WebTestClient buildClient() {
|
|
private WebTestClient buildClient() {
|
|
- return WebTestClientBuilder.bindToWebFilters(headers.build()).build();
|
|
|
|
|
|
+ return WebTestClientBuilder.bindToWebFilters(this.headers.build()).build();
|
|
}
|
|
}
|
|
}
|
|
}
|