mirror of
https://github.com/hanzoai/gateway.git
synced 2026-10-30 15:04:44 +00:00
zeekayandHanzo Dev
ba630564b0
These seven specs described a product this repo is not. They were inherited from
upstream and never rewritten, so they could only have passed on a build that
still had upstream's cors service plugin wired and upstream's health endpoint —
which is why they were still failing the moment the suite was made to run at all.
Each now asserts what this gateway actually promises, and each says why in
@comment so the next reader does not have to re-derive it.
cors_1..5 — routes.go owns the ONE CORS policy (corsPreflightMiddleware +
newCORSOriginAllower), and it is an ALLOWLIST that echoes the origin and grants
credentials. Upstream's plugin answered every preflight 204 with `*`. The rewrite
keeps a positive case and STRENGTHENS the negative ones rather than converting
them away:
cors_1 allowlisted preflight -> 204, origin echoed (never `*`), Vary: Origin
cors_2 foreign preflight -> NO Access-Control-Allow-* at all
cors_3 suffix look-alike -> hanzo.ai.attacker.example gets nothing,
pinning the dot-boundary in isAllowedOrigin
cors_4 allowlisted simple GET -> grant is on the real response too
cors_5 foreign simple GET -> 200 with no grant, and no X-Powered-By /
X-Krakend: the framework is never disclosed
An expected header of [""] asserts ABSENCE (assertResponse), so those are real
assertions, not omissions.
integration_jsonschema — required lura's `agents` and `now` fields against
/healthz, which is OUR endpoint (legacy_engine.go), not lura's /__health. The
spec was retargeted from /__health to /healthz in efa9cd78 and the schema was
never rewritten with it, so no build of this gateway has ever satisfied it. Now:
exactly {"status":"ok"}, additionalProperties:false — a probe body must not grow
fields that leak internal state.
negotitate_plain — both values moved with gin and the CURRENT ones are correct:
gin >=1.10 emits the RFC 9512 media type application/yaml (application/x-yaml was
the pre-RFC name) and gin 1.12 marshals via goccy/go-yaml, whose indent is 2
where gopkg.in/yaml.v3's was 4.
Co-authored-by: Hanzo Dev <[email protected]>
28 lines
1.1 KiB
JSON
28 lines
1.1 KiB
JSON
{
|
|
"@comment": "cors_4's request from a FOREIGN origin: the endpoint still answers 200 (it is not origin-gated) but carries no CORS grant, so the browser refuses to hand the body to the page. Also pins the posture ProductionHeadersMiddleware (rebrand.go) stamps on EVERY response: no X-Powered-By and no X-KRAKEND — the framework and its version are never disclosed — plus Server / nosniff / HSTS.",
|
|
"in": {
|
|
"method": "GET",
|
|
"url": "http://localhost:8080/param_forwarding/some/foo/bar",
|
|
"header": {
|
|
"User-Agent": "some",
|
|
"Origin": "http://foo.example.tld"
|
|
}
|
|
},
|
|
"out": {
|
|
"status_code": 200,
|
|
"header": {
|
|
"content-type": ["application/json; charset=utf-8"],
|
|
"Cache-Control": ["public, max-age=3600"],
|
|
"X-Gateway-Completed": ["true"],
|
|
"Access-Control-Allow-Origin": [""],
|
|
"Access-Control-Allow-Credentials": [""],
|
|
"X-Powered-By": [""],
|
|
"X-Krakend": [""],
|
|
"X-Krakend-Completed": [""],
|
|
"Server": ["gateway"],
|
|
"X-Content-Type-Options": ["nosniff"],
|
|
"Strict-Transport-Security": ["max-age=63072000; includeSubDomains"]
|
|
}
|
|
}
|
|
}
|