| 55 | self.assertEqual(response.headers["Access-Control-Allow-Origin"], "http://dev") |
| 56 | |
| 57 | def test_wrong_origin(self): |
| 58 | # Invalid origin (not specified in the config), we return first allowed origin specified |
| 59 | # in the config |
| 60 | response = self.app.get("/", headers={"origin": "http://xss"}) |
| 61 | self.assertEqual(response.status_int, 200) |
| 62 | self.assertEqual( |
| 63 | response.headers.get("Access-Control-Allow-Origin"), "http://127.0.0.1:3000" |
| 64 | ) |
| 65 | |
| 66 | invalid_origins = [ |
| 67 | "http://", |
| 68 | "https://", |
| 69 | "https://www.example.com", |
| 70 | "null", |
| 71 | "*", |
| 72 | ] |
| 73 | |
| 74 | for origin in invalid_origins: |
| 75 | response = self.app.get("/", headers={"origin": origin}) |
| 76 | self.assertEqual(response.status_int, 200) |
| 77 | self.assertEqual( |
| 78 | response.headers.get("Access-Control-Allow-Origin"), |
| 79 | "http://127.0.0.1:3000", |
| 80 | ) |
| 81 | |
| 82 | def test_wildcard_origin(self): |
| 83 | try: |