Nick SzaunigandClaude Opus 5.5
9ae1d96a32
- ThrottlerGuard runs first, so requests with wrong tokens or API keys count against the rate limit before any database lookup. - TRUST_PROXY (hop count or Express list) replaces the hard-coded 1. - Every API answer except the public lot pages is Cache-Control: no-store without ETag; helmet sends default-src 'none' / frame-ancestors 'none' (Swagger keeps the page policy when enabled) and same-site CORP. - Request log lines carry the path only - no query strings (the SSO callback's code and state no longer reach the logs). - In production the server refuses to start without an https FRONTEND_ORIGIN or with COOKIE_SECURE=false. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
45 lines
1.4 KiB
TypeScript
45 lines
1.4 KiB
TypeScript
import { INestApplication } from '@nestjs/common';
|
|
import request from 'supertest';
|
|
import { App } from 'supertest/types';
|
|
import { createTestApp } from './utils/create-test-app';
|
|
|
|
describe('Security headers (e2e)', () => {
|
|
let app: INestApplication<App>;
|
|
|
|
beforeAll(async () => {
|
|
app = await createTestApp();
|
|
});
|
|
|
|
afterAll(async () => {
|
|
await app.close();
|
|
});
|
|
|
|
it('marks API answers no-store, unframeable and without an ETag', async () => {
|
|
const response = await request(app.getHttpServer())
|
|
.get('/api/v1/auth/sso/status')
|
|
.expect(200);
|
|
|
|
expect(response.headers['cache-control']).toBe('no-store');
|
|
expect(response.headers['content-security-policy']).toContain(
|
|
"default-src 'none'",
|
|
);
|
|
expect(response.headers['content-security-policy']).toContain(
|
|
"frame-ancestors 'none'",
|
|
);
|
|
expect(response.headers['etag']).toBeUndefined();
|
|
expect(response.headers['x-powered-by']).toBeUndefined();
|
|
});
|
|
|
|
it('rate-limits requests with a wrong API key like any other', async () => {
|
|
const server = app.getHttpServer();
|
|
const statuses: number[] = [];
|
|
for (let i = 0; i < 105 && !statuses.includes(429); i++) {
|
|
const response = await request(server)
|
|
.get('/api/v1/shop-sync')
|
|
.set('Authorization', `Bearer ack_aaaaaaaa_${'A'.repeat(43)}`);
|
|
statuses.push(response.status);
|
|
}
|
|
expect(statuses).toContain(429);
|
|
});
|
|
});
|