CORS header tests for Gateway
- Implements https://github.com/ipfs/go-ipfs/pull/2232#issuecomment-173742385 - Separate test suite: - we don't want to pollute other gateway tests with CORS headers - (as of now) changing headers requires daemon restart anyway License: MIT Signed-off-by: Marcin Rataj <lidel@lidel.org>
Marcin Rataj committed
Jan 22, 2016 at 23:41 UTC
15d717c165462765ac25438c42da48c6de620ad9
1 file changed
+78
test/sharness/t0112-gateway-cors.sh
new
+78
@@ -0,0 +1,78 @@
1
+#!/bin/sh
2
+#
3
+# Copyright (c) 2016 Marcin Rataj
4
+# MIT Licensed; see the LICENSE file in this repository.
5
+#
6
+
7
+test_description="Test HTTP Gateway CORS Support"
8
+
9
+test_config_ipfs_cors_headers() {
10
+ ipfs config --json Gateway.HTTPHeaders.Access-Control-Allow-Origin '["*"]'
11
+ ipfs config --json Gateway.HTTPHeaders.Access-Control-Allow-Methods '["PUT", "GET", "POST"]'
12
+ ipfs config --json Gateway.HTTPHeaders.Access-Control-Allow-Headers '["X-Requested-With"]'
13
+
14
+ ipfs config --json API.HTTPHeaders.Access-Control-Allow-Origin '["*"]'
15
+ ipfs config --json API.HTTPHeaders.Access-Control-Allow-Methods '["PUT", "GET", "POST"]'
16
+ ipfs config --json API.HTTPHeaders.Access-Control-Allow-Headers '["X-Requested-With"]'
17
+}
18
+
19
+. lib/test-lib.sh
20
+
21
+test_init_ipfs
22
+test_config_ipfs_gateway_readonly $ADDR_GWAY
23
+test_config_ipfs_cors_headers
24
+test_launch_ipfs_daemon
25
+
26
+gwport=$PORT_GWAY
27
+apiport=$PORT_API
28
+thash='QmUNLLsPACCz1vLxQVkXqqLX5R1X345qqfHbsf67hvA3Nn'
29
+
30
+# Gateway
31
+
32
+# HTTP GET Request
33
+test_expect_success "GET to Gateway succeeds" '
34
+ curl -svX GET "http://127.0.0.1:$gwport/ipfs/$thash" 2>curl_output
35
+'
36
+# GET Response from Gateway should contain CORS headers
37
+test_expect_success "GET response for Gateway resource looks good" '
38
+ grep "Access-Control-Allow-Origin:" curl_output &&
39
+ grep "Access-Control-Allow-Methods:" curl_output &&
40
+ grep "Access-Control-Allow-Headers:" curl_output
41
+'
42
+
43
+# HTTP OPTIONS Request
44
+test_expect_success "OPTIONS to Gateway succeeds" '
45
+ curl -svX OPTIONS "http://127.0.0.1:$gwport/ipfs/$thash" 2>curl_output
46
+'
47
+# OPTION Response from Gateway should contain CORS headers
48
+test_expect_success "OPTIONS response for Gateway resource looks good" '
49
+ grep "Access-Control-Allow-Origin:" curl_output &&
50
+ grep "Access-Control-Allow-Methods:" curl_output &&
51
+ grep "Access-Control-Allow-Headers:" curl_output
52
+'
53
+
54
+# Read-Only API (at the Gateway Port)
55
+
56
+# HTTP GET Request
57
+test_expect_success "GET to API succeeds" '
58
+ curl -svX GET "http://127.0.0.1:$gwport/api/v0/cat?arg=$thash" 2>curl_output
59
+'
60
+# GET Response from the API should NOT contain CORS headers
61
+# Blacklisting: https://git.io/vzaj2
62
+# Rationale: https://git.io/vzajX
63
+test_expect_success "OPTIONS response for API looks good" '
64
+ grep -q "Access-Control-Allow-" curl_output && false || true
65
+'
66
+
67
+# HTTP OPTIONS Request
68
+test_expect_success "OPTIONS to API succeeds" '
69
+ curl -svX OPTIONS "http://127.0.0.1:$gwport/api/v0/cat?arg=$thash" 2>curl_output
70
+'
71
+# OPTIONS Response from the API should NOT contain CORS headers
72
+test_expect_success "OPTIONS response for API looks good" '
73
+ grep -q "Access-Control-Allow-" curl_output && false || true
74
+'
75
+
76
+test_kill_ipfs_daemon
77
+
78
+test_done