poslop/palette
1
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases 2 Wiki Activity

fix #84: security headers dropped because they were set post-flush; set pre-handler
CI / test (pull_request) Successful in 21s
Details
CI / docker (pull_request) Skipped
Details

Browse Source
This commit is contained in:
fen
2026-09-09 10:54:16 -05:00
parent 7ca1b58362
commit 3d415edbdc
2 changed files with 17 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/web/securityheaders_test.go
+8 -18
View File
@@ -3,7 +3,6 @@ package web
import (
"net/http"
"net/http/httptest"
"strings"
"testing"
)
@@ -28,29 +27,20 @@ func TestSecurityHeaders(t *testing.T) {
t.Errorf("X-Content-Type-Options = %q, want nosniff", got)
}
// JSON response: no security headers.
// JSON/raw responses: headers are now set unconditionally BEFORE the handler
// runs. The previous post-handler approach was silently dropped once a page
// handler flushed its template output (headers must be set before WriteHeader).
// CSP/nosniff/referrer on non-HTML bodies is harmless and desirable.
jsonh := SecurityHeaders(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
w.Header().Set("Content-Type", "application/json")
w.Write([]byte(`{"ok":true}`))
}))
rec = httptest.NewRecorder()
jsonh.ServeHTTP(rec, httptest.NewRequest("GET", "/api/x", nil))
if got := rec.Header().Get("Content-Security-Policy"); got != "" {
t.Errorf("unexpected CSP %q on JSON response", got)
if got := rec.Header().Get("Content-Security-Policy"); got != wantCSP {
t.Errorf("CSP missing on JSON response: got %q", got)
}
if got := rec.Header().Get("Referrer-Policy"); got != "" {
t.Errorf("unexpected Referrer-Policy %q on JSON response", got)
}
// Content type set after the first Write (as the inline can page does) is
// still picked up because headers are inspected post-handler.
lateh := SecurityHeaders(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
w.Write([]byte("<html></html>"))
w.Header().Set("Content-Type", "text/html; charset=utf-8")
}))
rec = httptest.NewRecorder()
lateh.ServeHTTP(rec, httptest.NewRequest("GET", "/", nil))
if got := rec.Header().Get("Content-Security-Policy"); !strings.Contains(got, "frame-ancestors 'none'") {
t.Errorf("CSP = %q, want frame-ancestors 'none'", got)
if got := rec.Header().Get("Referrer-Policy"); got != "no-referrer" {
t.Errorf("Referrer-Policy missing on JSON response: got %q", got)
}
}