kibana-with-account/src/server/http/__tests__/xsrf.js

kibana-with-account is develop based kibana project

import expect from 'expect.js';
import { fromNode as fn } from 'bluebird';
import { resolve } from 'path';

import KbnServer from '../../KbnServer';

const nonDestructiveMethods = ['GET'];
const destructiveMethods = ['POST', 'PUT', 'DELETE'];
const src = resolve.bind(null, __dirname, '../../../../src');

const xsrfHeader = 'kbn-version';
const version = require(src('../package.json')).version;

describe('xsrf request filter', function () {
  function inject(kbnServer, opts) {
    return fn(cb => {
      kbnServer.server.inject(opts, (resp) => {
        cb(null, resp);
      });
    });
  }

  const makeServer = async function () {
    const kbnServer = new KbnServer({
      server: { autoListen: false },
      plugins: { scanDirs: [src('plugins')] },
      logging: { quiet: true },
      optimize: { enabled: false },
      elasticsearch: {
        url: 'http://localhost:9210'
      }
    });

    await kbnServer.ready();

    kbnServer.server.route({
      path: '/xsrf/test/route',
      method: [...nonDestructiveMethods, ...destructiveMethods],
      handler: function (req, reply) {
        reply(null, 'ok');
      }
    });

    return kbnServer;
  };

  let kbnServer;
  beforeEach(async () => kbnServer = await makeServer());
  afterEach(async () => await kbnServer.close());

  for (const method of nonDestructiveMethods) {
    context(`nonDestructiveMethod: ${method}`, function () { // eslint-disable-line no-loop-func
      it('accepts requests without a token', async function () {
        const resp = await inject(kbnServer, {
          url: '/xsrf/test/route',
          method: method
        });

        expect(resp.statusCode).to.be(200);
        expect(resp.payload).to.be('ok');
      });

      it('failes on invalid tokens', async function () {
        const resp = await inject(kbnServer, {
          url: '/xsrf/test/route',
          method: method,
          headers: {
            [xsrfHeader]: `invalid:${version}`,
          },
        });

        expect(resp.statusCode).to.be(400);
        expect(resp.headers).to.have.property(xsrfHeader, version);
        expect(resp.payload).to.match(/"Browser client is out of date/);
      });
    });
  }

  for (const method of destructiveMethods) {
    context(`destructiveMethod: ${method}`, function () { // eslint-disable-line no-loop-func
      it('accepts requests with the correct token', async function () {
        const resp = await inject(kbnServer, {
          url: '/xsrf/test/route',
          method: method,
          headers: {
            [xsrfHeader]: version,
          },
        });

        expect(resp.statusCode).to.be(200);
        expect(resp.payload).to.be('ok');
      });

      it('rejects requests without a token', async function () {
        const resp = await inject(kbnServer, {
          url: '/xsrf/test/route',
          method: method
        });

        expect(resp.statusCode).to.be(400);
        expect(resp.payload).to.match(/"Missing kbn-version header/);
      });

      it('rejects requests with an invalid token', async function () {
        const resp = await inject(kbnServer, {
          url: '/xsrf/test/route',
          method: method,
          headers: {
            [xsrfHeader]: `invalid:${version}`,
          },
        });

        expect(resp.statusCode).to.be(400);
        expect(resp.payload).to.match(/"Browser client is out of date/);
      });
    });
  }
});