feat: harden end-to-end simulation workflow

2026-08-28 12:34:11 +09:00
parent 2ce96064cf
commit 3317a03d1a
17 changed files with 577 additions and 24 deletions
@@ -0,0 +1,14 @@
+test("로컬 서버가 숨김 경로와 쓰기 method를 차단하고 보안 header를 보낸다", async () => {
+  const hiddenResponse = await fetch("/.git/config");
+  assertEqual(hiddenResponse.status, 403, "hidden repository path");
+
+  const postResponse = await fetch("/", { method: "POST" });
+  assertEqual(postResponse.status, 405, "unsupported method");
+  assertEqual(postResponse.headers.get("allow"), "GET, HEAD", "allowed methods");
+
+  const rootResponse = await fetch("/");
+  assertEqual(rootResponse.status, 200, "root remains available");
+  assertEqual(rootResponse.headers.get("x-content-type-options"), "nosniff", "nosniff header");
+  assertEqual(rootResponse.headers.get("referrer-policy"), "no-referrer", "referrer policy");
+  assert(rootResponse.headers.get("content-security-policy")?.includes("worker-src 'self'"), "worker CSP");
+});