| 1 | #!/usr/bin/env bash |
| 2 | # |
| 3 | # Copyright (c) 2020 Protocol Labs |
| 4 | # MIT Licensed; see the LICENSE file in this repository. |
| 5 | # |
| 6 | |
| 7 | test_description="Test API browser security" |
| 8 | |
| 9 | . lib/test-lib.sh |
| 10 | |
| 11 | test_init_ipfs |
| 12 | |
| 13 | PEERID=$(ipfs config Identity.PeerID) |
| 14 | |
| 15 | test_launch_ipfs_daemon |
| 16 | |
| 17 | test_expect_success "browser is unable to access API without Origin" ' |
| 18 | curl -sD - -X POST -A "Mozilla" "http://127.0.0.1:$API_PORT/api/v0/id" >curl_output && |
| 19 | grep "HTTP/1.1 403 Forbidden" curl_output |
| 20 | ' |
| 21 | |
| 22 | test_expect_success "browser is unable to access API with invalid Origin" ' |
| 23 | curl -sD - -X POST -A "Mozilla" -H "Origin: https://invalid.example.com" "http://127.0.0.1:$API_PORT/api/v0/id" >curl_output && |
| 24 | grep "HTTP/1.1 403 Forbidden" curl_output |
| 25 | ' |
| 26 | |
| 27 | test_expect_success "browser is able to access API if Origin is the API port on localhost (ipv4)" ' |
| 28 | curl -sD - -X POST -A "Mozilla" -H "Origin: http://127.0.0.1:$API_PORT" "http://127.0.0.1:$API_PORT/api/v0/id" >curl_output && |
| 29 | grep "HTTP/1.1 200 OK" curl_output && grep "$PEERID" curl_output |
| 30 | ' |
| 31 | |
| 32 | test_expect_success "browser is able to access API if Origin is the API port on localhost (ipv6)" ' |
| 33 | curl -sD - -X POST -A "Mozilla" -H "Origin: http://[::1]:$API_PORT" "http://127.0.0.1:$API_PORT/api/v0/id" >curl_output && |
| 34 | grep "HTTP/1.1 200 OK" curl_output && grep "$PEERID" curl_output |
| 35 | ' |
| 36 | |
| 37 | test_expect_success "browser is able to access API if Origin is the API port on localhost (localhost name)" ' |
| 38 | curl -sD - -X POST -A "Mozilla" -H "Origin: http://localhost:$API_PORT" "http://127.0.0.1:$API_PORT/api/v0/id" >curl_output && |
| 39 | grep "HTTP/1.1 200 OK" curl_output && grep "$PEERID" curl_output |
| 40 | ' |
| 41 | |
| 42 | test_expect_success "Random browser extension is unable to access RPC API due to invalid Origin" ' |
| 43 | curl -sD - -X POST -A "Mozilla" -H "Origin: chrome-extension://invalidextensionid" "http://127.0.0.1:$API_PORT/api/v0/id" >curl_output && |
| 44 | grep "HTTP/1.1 403 Forbidden" curl_output |
| 45 | ' |
| 46 | |
| 47 | test_expect_success "Companion extension is able to access RPC API on localhost" ' |
| 48 | curl -sD - -X POST -A "Mozilla" -H "Origin: chrome-extension://nibjojkomfdiaoajekhjakgkdhaomnch" "http://127.0.0.1:$API_PORT/api/v0/id" >curl_output && |
| 49 | cat curl_output && |
| 50 | grep "HTTP/1.1 200 OK" curl_output && grep "$PEERID" curl_output |
| 51 | ' |
| 52 | |
| 53 | test_expect_success "Companion beta extension is able to access API on localhost" ' |
| 54 | curl -sD - -X POST -A "Mozilla" -H "Origin: chrome-extension://hjoieblefckbooibpepigmacodalfndh" "http://127.0.0.1:$API_PORT/api/v0/id" >curl_output && |
| 55 | grep "HTTP/1.1 200 OK" curl_output && grep "$PEERID" curl_output |
| 56 | ' |
| 57 | |
| 58 | test_kill_ipfs_daemon |
| 59 | |
| 60 | test_expect_success "setting CORS in API.HTTPHeaders works via CLI" " |
| 61 | ipfs config --json API.HTTPHeaders.Access-Control-Allow-Origin '[\"https://valid.example.com\"]' && |
| 62 | ipfs config --json API.HTTPHeaders.Access-Control-Allow-Methods '[\"POST\"]' && |
| 63 | ipfs config --json API.HTTPHeaders.Access-Control-Allow-Headers '[\"X-Requested-With\"]' |
| 64 | " |
| 65 | |
| 66 | test_launch_ipfs_daemon |
| 67 | |
| 68 | test_expect_success "Companion extension is able to access RPC API even when custom Access-Control-Allow-Origin is set" ' |
| 69 | ipfs config --json API.HTTPHeaders.Access-Control-Allow-Origin | grep -q valid.example.com && |
| 70 | curl -sD - -X POST -A "Mozilla" -H "Origin: chrome-extension://nibjojkomfdiaoajekhjakgkdhaomnch" "http://127.0.0.1:$API_PORT/api/v0/id" >curl_output && |
| 71 | cat curl_output && |
| 72 | grep "HTTP/1.1 200 OK" curl_output && |
| 73 | grep "$PEERID" curl_output |
| 74 | ' |
| 75 | |
| 76 | # https://developer.mozilla.org/en-US/docs/Glossary/Preflight_request |
| 77 | test_expect_success "OPTIONS with preflight request to API with CORS allowlist succeeds" ' |
| 78 | curl -svX OPTIONS -A "Mozilla" -H "Origin: https://valid.example.com" -H "Access-Control-Request-Method: POST" -H "Access-Control-Request-Headers: origin, x-requested-with" "http://127.0.0.1:$API_PORT/api/v0/id" 2>curl_output && |
| 79 | cat curl_output |
| 80 | ' |
| 81 | |
| 82 | # OPTION Response from Gateway should contain CORS headers, otherwise JS won't work |
| 83 | test_expect_success "OPTIONS response for API with CORS allowslist looks good" ' |
| 84 | grep "< Access-Control-Allow-Origin: https://valid.example.com" curl_output |
| 85 | ' |
| 86 | |
| 87 | test_expect_success "browser is able to access API with valid Origin matching CORS allowlist" ' |
| 88 | curl -sD - -X POST -A "Mozilla" -H "Origin: https://valid.example.com" "http://127.0.0.1:$API_PORT/api/v0/id" >curl_output && |
| 89 | grep "HTTP/1.1 200 OK" curl_output && grep "$PEERID" curl_output |
| 90 | ' |
| 91 | |
| 92 | test_kill_ipfs_daemon |
| 93 | test_done |