@cryptotaxi247 / kubo
Code Commits Issues Pulls Sessions CI/CD
master
master
sh 132 lines 6.47 KB
Raw
1 #!/usr/bin/env bash
2
3 test_description="Test CORS behavior on Gateway port"
4
5 . lib/test-lib.sh
6
7 test_init_ipfs
8
9 # Default config
10 test_expect_success "Default Gateway.HTTPHeaders is empty (implicit CORS values from boxo/gateway)" '
11 cat <<EOF > expected
12 {}
13 EOF
14 ipfs config --json Gateway.HTTPHeaders > actual &&
15 test_cmp expected actual
16 '
17
18 test_launch_ipfs_daemon
19
20 thash='bafkqabtimvwgy3yk' # hello
21
22 # Gateway
23
24 # HTTP GET Request
25 test_expect_success "GET to Gateway succeeds" '
26 curl -svX GET -H "Origin: https://example.com" "http://127.0.0.1:$GWAY_PORT/ipfs/$thash" >/dev/null 2>curl_output &&
27 cat curl_output
28 '
29
30 # GET Response from Gateway should contain CORS headers
31 test_expect_success "GET response for Gateway resource looks good" '
32 test_should_contain "< Access-Control-Allow-Origin: \*" curl_output &&
33 test_should_contain "< Access-Control-Allow-Methods: GET" curl_output &&
34 test_should_contain "< Access-Control-Allow-Methods: HEAD" curl_output &&
35 test_should_contain "< Access-Control-Allow-Methods: OPTIONS" curl_output &&
36 test_should_contain "< Access-Control-Allow-Headers: Content-Type" curl_output &&
37 test_should_contain "< Access-Control-Allow-Headers: Range" curl_output &&
38 test_should_contain "< Access-Control-Allow-Headers: User-Agent" curl_output &&
39 test_should_contain "< Access-Control-Allow-Headers: X-Requested-With" curl_output &&
40 test_should_contain "< Access-Control-Expose-Headers: Content-Range" curl_output &&
41 test_should_contain "< Access-Control-Expose-Headers: Content-Length" curl_output &&
42 test_should_contain "< Access-Control-Expose-Headers: X-Chunked-Output" curl_output &&
43 test_should_contain "< Access-Control-Expose-Headers: X-Stream-Output" curl_output &&
44 test_should_contain "< Access-Control-Expose-Headers: X-Ipfs-Path" curl_output &&
45 test_should_contain "< Access-Control-Expose-Headers: X-Ipfs-Roots" curl_output
46 '
47 # HTTP OPTIONS Request
48 test_expect_success "OPTIONS to Gateway succeeds" '
49 curl -svX OPTIONS -H "Origin: https://example.com" "http://127.0.0.1:$GWAY_PORT/ipfs/$thash" 2>curl_output &&
50 cat curl_output
51 '
52
53 # OPTION Response from Gateway should contain CORS headers
54 test_expect_success "OPTIONS response for Gateway resource looks good" '
55 test_should_contain "< Access-Control-Allow-Origin: \*" curl_output &&
56 test_should_contain "< Access-Control-Allow-Methods: GET" curl_output &&
57 test_should_contain "< Access-Control-Allow-Methods: HEAD" curl_output &&
58 test_should_contain "< Access-Control-Allow-Methods: OPTIONS" curl_output &&
59 test_should_contain "< Access-Control-Allow-Headers: Content-Type" curl_output &&
60 test_should_contain "< Access-Control-Allow-Headers: Range" curl_output &&
61 test_should_contain "< Access-Control-Allow-Headers: User-Agent" curl_output &&
62 test_should_contain "< Access-Control-Allow-Headers: X-Requested-With" curl_output &&
63 test_should_contain "< Access-Control-Expose-Headers: Content-Range" curl_output &&
64 test_should_contain "< Access-Control-Expose-Headers: Content-Length" curl_output &&
65 test_should_contain "< Access-Control-Expose-Headers: X-Chunked-Output" curl_output &&
66 test_should_contain "< Access-Control-Expose-Headers: X-Stream-Output" curl_output &&
67 test_should_contain "< Access-Control-Expose-Headers: X-Ipfs-Path" curl_output &&
68 test_should_contain "< Access-Control-Expose-Headers: X-Ipfs-Roots" curl_output
69 '
70
71 # HTTP OPTIONS Request on path → subdomain HTTP 301 redirect
72 # (regression test for https://github.com/ipfs/kubo/issues/9983#issuecomment-1599673976)
73 test_expect_success "OPTIONS to Gateway succeeds" '
74 curl -svX OPTIONS -H "Origin: https://example.com" "http://localhost:$GWAY_PORT/ipfs/$thash" 2>curl_output &&
75 cat curl_output
76 '
77 # OPTION Response from Gateway should contain CORS headers
78 test_expect_success "OPTIONS response for subdomain redirect looks good" '
79 test_should_contain "HTTP/1.1 301 Moved Permanently" curl_output &&
80 test_should_contain "Location" curl_output &&
81 test_should_contain "< Access-Control-Allow-Origin: \*" curl_output &&
82 test_should_contain "< Access-Control-Allow-Methods: GET" curl_output
83 '
84
85 test_kill_ipfs_daemon
86
87 # Test CORS safelisting of custom headers
88 test_expect_success "Can configure gateway headers" '
89 ipfs config --json Gateway.HTTPHeaders.Access-Control-Allow-Headers "[\"X-Custom1\"]" &&
90 ipfs config --json Gateway.HTTPHeaders.Access-Control-Expose-Headers "[\"X-Custom2\"]" &&
91 ipfs config --json Gateway.HTTPHeaders.Access-Control-Allow-Origin "[\"localhost\"]"
92 '
93
94 test_launch_ipfs_daemon
95
96 test_expect_success "OPTIONS to Gateway without custom headers succeeds" '
97 curl -svX OPTIONS -H "Origin: https://example.com" "http://127.0.0.1:$GWAY_PORT/ipfs/$thash" 2>curl_output &&
98 cat curl_output
99 '
100 # Range and Content-Range are safelisted by default, and keeping them makes better devexp
101 # because it does not cause regressions in range requests made by JS
102 test_expect_success "Access-Control-Allow-Headers extends the implicit list" '
103 test_should_contain "< Access-Control-Allow-Headers: Range" curl_output &&
104 test_should_contain "< Access-Control-Allow-Headers: X-Custom1" curl_output &&
105 test_should_contain "< Access-Control-Expose-Headers: Content-Range" curl_output &&
106 test_should_contain "< Access-Control-Expose-Headers: Content-Length" curl_output &&
107 test_should_contain "< Access-Control-Expose-Headers: X-Ipfs-Path" curl_output &&
108 test_should_contain "< Access-Control-Expose-Headers: X-Ipfs-Roots" curl_output &&
109 test_should_contain "< Access-Control-Expose-Headers: X-Custom2" curl_output
110 '
111
112 test_expect_success "OPTIONS to Gateway with a custom header succeeds" '
113 curl -svX OPTIONS -H "Origin: https://example.com" -H "Access-Control-Request-Headers: X-Unexpected-Custom" "http://127.0.0.1:$GWAY_PORT/ipfs/$thash" 2>curl_output &&
114 cat curl_output
115 '
116 test_expect_success "Access-Control-Allow-Headers extends the implicit list" '
117 test_should_not_contain "< Access-Control-Allow-Headers: X-Unexpected-Custom" curl_output &&
118 test_should_contain "< Access-Control-Allow-Headers: Range" curl_output &&
119 test_should_contain "< Access-Control-Allow-Headers: X-Custom1" curl_output &&
120 test_should_contain "< Access-Control-Expose-Headers: Content-Range" curl_output &&
121 test_should_contain "< Access-Control-Expose-Headers: X-Custom2" curl_output
122 '
123
124 # Origin is sensitive security perimeter, and we assume override should remove
125 # any implicit records
126 test_expect_success "Access-Control-Allow-Origin replaces the implicit list" '
127 test_should_contain "< Access-Control-Allow-Origin: localhost" curl_output
128 '
129
130 test_kill_ipfs_daemon
131
132 test_done