36 lines
1.0 KiB
Python
36 lines
1.0 KiB
Python
 
|
"""B-43: the Caddyfile must keep sending baseline security headers. Caddy adds
|
||
|
|
none of these on its own, and the JWT lives in localStorage, so a regression
|
||
|
|
here silently reopens an XSS/clickjacking exposure with no test ever failing
|
||
|
|
in the Python suite (the Caddyfile isn't imported/exercised by anything else)."""
|
||
|
|
|
||
|
|
from pathlib import Path
|
||
|
|
|
||
|
|
CADDYFILE = (Path(__file__).parent.parent.parent / "Caddyfile").read_text()
|
||
|
|
|
||
|
|
|
||
|
|
def test_header_block_present():
|
||
|
|
assert "header {" in CADDYFILE
|
||
|
|
|
||
|
|
|
||
|
|
def test_hsts_is_set():
|
||
|
|
assert "Strict-Transport-Security" in CADDYFILE
|
||
|
|
assert "max-age=" in CADDYFILE
|
||
|
|
|
||
|
|
|
||
|
|
def test_nosniff_is_set():
|
||
|
|
assert 'X-Content-Type-Options "nosniff"' in CADDYFILE
|
||
|
|
|
||
|
|
|
||
|
|
def test_frame_ancestors_are_blocked():
|
||
|
|
assert 'X-Frame-Options "DENY"' in CADDYFILE
|
||
|
|
assert "frame-ancestors 'none'" in CADDYFILE
|
||
|
|
|
||
|
|
|
||
|
|
def test_referrer_policy_is_set():
|
||
|
|
assert "Referrer-Policy" in CADDYFILE
|
||
|
|
|
||
|
|
|
||
|
|
def test_csp_default_src_is_self():
|
||
|
|
assert "Content-Security-Policy" in CADDYFILE
|
||
|
|
assert "default-src 'self'" in CADDYFILE
|