diff --git a/src/Constants.cs b/src/Constants.cs index 9fe7770..5effed4 100644 --- a/src/Constants.cs +++ b/src/Constants.cs @@ -26,8 +26,8 @@ public static class Constants public const string ExpectCtHeaderName = "Expect-CT"; public const string CrossOriginResourcePolicyHeaderName = "Cross-Origin-Resource-Policy"; - + public const string CrossOriginOpenerPolicyHeaderName = "Cross-Origin-Opener-Policy"; - + public const string CrossOriginEmbedderPolicyHeaderName = "Cross-Origin-Embedder-Policy"; } diff --git a/src/Extensions/SecureHeadersMiddlewareBuilder.cs b/src/Extensions/SecureHeadersMiddlewareBuilder.cs index b1e6063..9fd8002 100644 --- a/src/Extensions/SecureHeadersMiddlewareBuilder.cs +++ b/src/Extensions/SecureHeadersMiddlewareBuilder.cs @@ -339,7 +339,7 @@ public static SecureHeadersMiddlewareConfiguration UseCrossOriginOpenerPolicy( config.CrossOriginOpenerPolicy = new CrossOriginOpenerPolicy(value); return config; } - + /// /// The HTTP Cross-Origin-Embedder-Policy (COEP) response header configures embedding /// cross-origin resources into the document. diff --git a/src/Models/SecureHeadersMiddlewareConfiguration.cs b/src/Models/SecureHeadersMiddlewareConfiguration.cs index 5507078..84f2d58 100644 --- a/src/Models/SecureHeadersMiddlewareConfiguration.cs +++ b/src/Models/SecureHeadersMiddlewareConfiguration.cs @@ -71,7 +71,7 @@ public class SecureHeadersMiddlewareConfiguration /// Indicates whether the response should use Cross-Origin-Opener-Policy /// public bool UseCrossOriginOpenerPolicy { get; set; } - + /// /// Indicates whether the response should use Cross-Origin-Embedder-Policy /// @@ -125,7 +125,7 @@ public class SecureHeadersMiddlewareConfiguration public CrossOriginResourcePolicy CrossOriginResourcePolicy { get; set; } public CrossOriginOpenerPolicy CrossOriginOpenerPolicy { get; set; } - + public CrossOriginEmbedderPolicy CrossOriginEmbedderPolicy { get; set; } /// diff --git a/src/SecureHeadersMiddleware.cs b/src/SecureHeadersMiddleware.cs index d8cabcc..48641d8 100644 --- a/src/SecureHeadersMiddleware.cs +++ b/src/SecureHeadersMiddleware.cs @@ -131,7 +131,7 @@ private FrozenDictionary GenerateRelevantHeaders() temporaryDictionary.Add(Constants.CrossOriginOpenerPolicyHeaderName, _config.CrossOriginOpenerPolicy.BuildHeaderValue()); } - + if (_config.UseCrossOriginEmbedderPolicy) { if (!_config.UseCrossOriginResourcePolicy) diff --git a/tests/OwaspHeaders.Core.Tests/CustomHeaders/CrossOriginOptionsTests.cs b/tests/OwaspHeaders.Core.Tests/CustomHeaders/CrossOriginOptionsTests.cs index 93eda15..3d6d484 100644 --- a/tests/OwaspHeaders.Core.Tests/CustomHeaders/CrossOriginOptionsTests.cs +++ b/tests/OwaspHeaders.Core.Tests/CustomHeaders/CrossOriginOptionsTests.cs @@ -39,7 +39,7 @@ public async Task When_UseCrossOriginOpenerPolicyCalled_Header_Is_Present() Assert.Equal(CrossOriginOpenerPolicy.SameOriginValue, _context.Response.Headers[Constants.CrossOriginOpenerPolicyHeaderName]); } - + [Fact] public async Task When_UseCrossOriginEmbedderPolicyCalled_Header_Is_Present() { @@ -56,16 +56,16 @@ public async Task When_UseCrossOriginEmbedderPolicyCalled_Header_Is_Present() // assert Assert.True(headerPresentConfig.UseCrossOriginEmbedderPolicy); Assert.True(headerPresentConfig.UseCrossOriginResourcePolicy); - + Assert.True(_context.Response.Headers.ContainsKey(Constants.CrossOriginResourcePolicyHeaderName)); Assert.Equal(CrossOriginResourcePolicy.SameOriginValue, _context.Response.Headers[Constants.CrossOriginResourcePolicyHeaderName]); - + Assert.True(_context.Response.Headers.ContainsKey(Constants.CrossOriginEmbedderPolicyHeaderName)); Assert.Equal(CrossOriginEmbedderPolicy.RequireCorp, _context.Response.Headers[Constants.CrossOriginEmbedderPolicyHeaderName]); } - + [Fact] public async Task When_UseCrossOriginEmbedderPolicyCalled_But_UseCrossOriginResourcePolicy_NotSupplied_Header_Is_Not_Present() { @@ -81,10 +81,10 @@ public async Task When_UseCrossOriginEmbedderPolicyCalled_But_UseCrossOriginReso // assert Assert.NotNull(exception); Assert.IsType(exception); - + Assert.True(headerPresentConfig.UseCrossOriginEmbedderPolicy); Assert.False(headerPresentConfig.UseCrossOriginResourcePolicy); - + Assert.False(_context.Response.Headers.ContainsKey(Constants.CrossOriginEmbedderPolicyHeaderName)); } @@ -119,7 +119,7 @@ public async Task When_UseCrossOriginOpenerPolicyNotCalled_Header_Not_Present() Assert.False(headerNotPresentConfig.UseCrossOriginOpenerPolicy); Assert.False(_context.Response.Headers.ContainsKey(Constants.CrossOriginOpenerPolicyHeaderName)); } - + [Fact] public async Task When_UseCrossOriginEmbedderPolicyNotCalled_Header_Not_Present() { diff --git a/tests/OwaspHeaders.Core.Tests/GuardClauses/HeaderValueGuardClausesStringValues.cs b/tests/OwaspHeaders.Core.Tests/GuardClauses/HeaderValueGuardClausesStringValues.cs index 1e5d91c..ab6ebda 100644 --- a/tests/OwaspHeaders.Core.Tests/GuardClauses/HeaderValueGuardClausesStringValues.cs +++ b/tests/OwaspHeaders.Core.Tests/GuardClauses/HeaderValueGuardClausesStringValues.cs @@ -7,23 +7,23 @@ public void TrueValue_ShouldNotThrow_ArgumentException() { // Arrange var argName = Guid.NewGuid().ToString(); - + // Act var exception = Record.Exception(() => Guards.BoolValueGuardClauses.MustBeTrue(true, argName)); - + // Assert Assert.Null(exception); } - + [Fact] public void FalseValue_ShouldThrow_ArgumentException() { // Arrange var argName = Guid.NewGuid().ToString(); - + // Act var exception = Record.Exception(() => Guards.BoolValueGuardClauses.MustBeTrue(false, argName)); - + // Assert Assert.NotNull(exception); Assert.IsType(exception);