File size: 1,343 Bytes
30c6f13 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 | from fastapi import FastAPI
from fastapi.testclient import TestClient
from backend.app.security_headers import (
PRODUCTION_CONTENT_SECURITY_POLICY,
install_security_headers,
)
EXPECTED_CSP = (
"default-src 'self'; script-src 'self'; style-src 'self'; connect-src 'self'; "
"img-src 'self'; font-src 'self'; object-src 'none'; base-uri 'self'; "
"form-action 'self'; frame-src 'none'; frame-ancestors 'none'; worker-src 'none'"
)
def _test_app() -> FastAPI:
app = FastAPI()
install_security_headers(app)
@app.get("/")
async def index():
return {"status": "ok"}
return app
def test_production_csp_is_enforcing_and_exact() -> None:
assert PRODUCTION_CONTENT_SECURITY_POLICY == EXPECTED_CSP
assert "'unsafe-inline'" not in PRODUCTION_CONTENT_SECURITY_POLICY
assert "'unsafe-eval'" not in PRODUCTION_CONTENT_SECURITY_POLICY
assert "*" not in PRODUCTION_CONTENT_SECURITY_POLICY
response = TestClient(_test_app()).get("/")
assert response.status_code == 200
assert response.headers["Content-Security-Policy"] == EXPECTED_CSP
assert "Content-Security-Policy-Report-Only" not in response.headers
def test_nosniff_header_is_enabled() -> None:
response = TestClient(_test_app()).get("/")
assert response.headers["X-Content-Type-Options"] == "nosniff"
|