2fff8a3aa5
All checks were successful
dev - build & deploy naar test / build-and-deploy (push) Successful in 1m4s
- gzip on + gzip_proxied any (zonder die laatste comprimeert nginx geproxyde responses helemaal niet) + gzip_vary + min_length 1024 voor css/js/json/svg/tekst - Geen dubbele compressie: responses die al Content-Encoding dragen (brotli/gzip uit de app) laat nginx ongemoeid; dit vangt alleen wat de app mist - Cache-beleid blijft bewust op één plek (de app), zodat lokaal en productie identiek gedragen - Configtest erbij in security-config-stijl Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0149FgUQvuwxKKEdvQGmNngF
28 lines
1.2 KiB
JavaScript
28 lines
1.2 KiB
JavaScript
import test from 'node:test';
|
|
import assert from 'node:assert/strict';
|
|
import { readFile } from 'node:fs/promises';
|
|
|
|
test('productieconfig gebruikt secure cookies en begrensde proxy trust', async () => {
|
|
const compose = await readFile('deploy/compose.deploy.yaml', 'utf8');
|
|
assert.match(compose, /COOKIE_SECURE: "true"/);
|
|
assert.match(compose, /TRUST_PROXY_HOPS:/);
|
|
assert.match(compose, /WEB_BIND_IP:-0\.0\.0\.0/);
|
|
});
|
|
|
|
test('nginx behoudt het publieke forwarded protocol', async () => {
|
|
const nginx = await readFile('deploy/nginx.conf', 'utf8');
|
|
assert.match(nginx, /http_x_forwarded_proto/);
|
|
assert.match(nginx, /X-Forwarded-Proto \$teach_forwarded_proto/);
|
|
});
|
|
|
|
test('nginx comprimeert geproxyde responses als vangnet', async () => {
|
|
const nginx = await readFile('deploy/nginx.conf', 'utf8');
|
|
/* zonder gzip_proxied comprimeert nginx geproxyde responses helemaal niet */
|
|
assert.match(nginx, /gzip_proxied any/);
|
|
assert.match(nginx, /gzip_vary on/);
|
|
});
|
|
|
|
test('client bewaart geen bearer-token meer', async () => {
|
|
const core = await readFile('public/js/core.js', 'utf8');
|
|
assert.doesNotMatch(core, /headers\.Authorization|localStorage\.setItem\("teach\.token"/);
|
|
});
|