53 lines
2.0 KiB
TypeScript
53 lines
2.0 KiB
TypeScript
import { normalizeOidcForwardedProto } from './oidc-forwarded-proto';
|
|
|
|
describe('normalizeOidcForwardedProto', () => {
|
|
it('corrects an OIDC request when the trusted public issuer uses HTTPS', () => {
|
|
const request = {
|
|
method: 'GET',
|
|
originalUrl: '/oidc/auth?client_id=test',
|
|
headers: { 'x-forwarded-proto': 'http' },
|
|
};
|
|
|
|
const result = normalizeOidcForwardedProto(request, 'https://auth.example.com', true);
|
|
|
|
expect(result).toEqual({ corrected: true, path: '/oidc/auth', previousProto: 'http' });
|
|
expect(request.headers['x-forwarded-proto']).toBe('https');
|
|
});
|
|
|
|
it('also corrects interaction routes used to finish login and consent', () => {
|
|
const request = { originalUrl: '/interaction/uid/login', headers: {} as Record<string, string> };
|
|
|
|
const result = normalizeOidcForwardedProto(request, 'https://auth.example.com', true);
|
|
|
|
expect(result.corrected).toBe(true);
|
|
expect(request.headers['x-forwarded-proto']).toBe('https');
|
|
});
|
|
|
|
it('does not alter unrelated API requests', () => {
|
|
const request = { originalUrl: '/api/account', headers: { 'x-forwarded-proto': 'http' } };
|
|
|
|
const result = normalizeOidcForwardedProto(request, 'https://auth.example.com', true);
|
|
|
|
expect(result.corrected).toBe(false);
|
|
expect(request.headers['x-forwarded-proto']).toBe('http');
|
|
});
|
|
|
|
it('does not override the protocol when proxy trust is disabled', () => {
|
|
const request = { originalUrl: '/oidc/auth', headers: { 'x-forwarded-proto': 'http' } };
|
|
|
|
const result = normalizeOidcForwardedProto(request, 'https://auth.example.com', false);
|
|
|
|
expect(result.corrected).toBe(false);
|
|
expect(request.headers['x-forwarded-proto']).toBe('http');
|
|
});
|
|
|
|
it('does not force HTTPS for a configured HTTP issuer', () => {
|
|
const request = { originalUrl: '/oidc/auth', headers: { 'x-forwarded-proto': 'http' } };
|
|
|
|
const result = normalizeOidcForwardedProto(request, 'http://localhost:8080', true);
|
|
|
|
expect(result.corrected).toBe(false);
|
|
expect(request.headers['x-forwarded-proto']).toBe('http');
|
|
});
|
|
});
|