Codex
15 lines
854 B
JavaScript
15 lines
854 B
JavaScript
test("로컬 서버가 숨김 경로와 쓰기 method를 차단하고 보안 header를 보낸다", async () => {
|
|
const hiddenResponse = await fetch("/.git/config");
|
|
assertEqual(hiddenResponse.status, 403, "hidden repository path");
|
|
|
|
const postResponse = await fetch("/", { method: "POST" });
|
|
assertEqual(postResponse.status, 405, "unsupported method");
|
|
assertEqual(postResponse.headers.get("allow"), "GET, HEAD", "allowed methods");
|
|
|
|
const rootResponse = await fetch("/");
|
|
assertEqual(rootResponse.status, 200, "root remains available");
|
|
assertEqual(rootResponse.headers.get("x-content-type-options"), "nosniff", "nosniff header");
|
|
assertEqual(rootResponse.headers.get("referrer-policy"), "no-referrer", "referrer policy");
|
|
assert(rootResponse.headers.get("content-security-policy")?.includes("worker-src 'self'"), "worker CSP");
|
|
});
|