0aed11cb01
- CORS 默认仅同源可用，跨域需显式配置 CORS_ORIGINS（非生产默认放行 localhost:5173） - 新增安全响应头：X-Content-Type-Options / X-Frame-Options / Referrer-Policy / X-XSS-Protection / Permissions-Policy；生产附加 HSTS - 关闭 X-Powered-By，设置 trust proxy - 文档补充 CORS_ORIGINS；新增回归护栏 cors-security-headers.spec.ts（85 套件/627 用例全绿）
26 行
1016 B
TypeScript
26 行
1016 B
TypeScript
// 已读取AGENTS.md
|
||
import * as fs from 'fs';
|
||
import * as path from 'path';
|
||
|
||
/**
|
||
* 第六十九批回归闸门：CORS 收敛 + 基础安全响应头
|
||
*/
|
||
describe('第六十九批 CORS 与安全响应头闸门', () => {
|
||
const rootDir = path.resolve(__dirname, '../../');
|
||
const indexCode = fs.readFileSync(path.join(rootDir, 'server/src/index.ts'), 'utf-8');
|
||
|
||
it('CORS 不再全开，改为白名单（CORS_ORIGINS）', () => {
|
||
expect(indexCode).not.toContain('app.use(cors());');
|
||
expect(indexCode).toContain('CORS_ORIGINS');
|
||
expect(indexCode).toContain('allowedCorsOrigins.has(origin)');
|
||
});
|
||
|
||
it('设置基础安全响应头并隐藏技术栈', () => {
|
||
expect(indexCode).toContain("app.disable('x-powered-by')");
|
||
expect(indexCode).toContain("'X-Content-Type-Options', 'nosniff'");
|
||
expect(indexCode).toContain("'X-Frame-Options', 'DENY'");
|
||
expect(indexCode).toContain("'Referrer-Policy', 'no-referrer'");
|
||
expect(indexCode).toContain('Strict-Transport-Security');
|
||
});
|
||
});
|