mirror of
https://github.com/0xJacky/nginx-ui.git
synced 2026-06-19 07:36:59 +00:00
0xJacky
413dc631ee
- Introduced `WebSocketTrustedOrigins` setting in `app.example.ini` and corresponding documentation. - Refactored WebSocket origin checks across multiple API endpoints to utilize the new middleware for improved security. - Added tests for the new origin validation logic to ensure proper handling of trusted origins and node secret requests.
36 lines
796 B
Go
36 lines
796 B
Go
package mcp
|
|
|
|
import (
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"testing"
|
|
|
|
"github.com/0xJacky/Nginx-UI/settings"
|
|
"github.com/gin-gonic/gin"
|
|
"github.com/stretchr/testify/assert"
|
|
)
|
|
|
|
func TestMCPEndpointsRequireAuthentication(t *testing.T) {
|
|
gin.SetMode(gin.TestMode)
|
|
|
|
originalIPWhiteList := settings.AuthSettings.IPWhiteList
|
|
t.Cleanup(func() {
|
|
settings.AuthSettings.IPWhiteList = originalIPWhiteList
|
|
})
|
|
|
|
settings.AuthSettings.IPWhiteList = nil
|
|
|
|
router := gin.New()
|
|
InitRouter(router)
|
|
|
|
for _, endpoint := range []string{"/mcp", "/mcp_message"} {
|
|
req := httptest.NewRequest(http.MethodPost, endpoint, nil)
|
|
w := httptest.NewRecorder()
|
|
|
|
router.ServeHTTP(w, req)
|
|
|
|
assert.Equal(t, http.StatusForbidden, w.Code)
|
|
assert.JSONEq(t, `{"message":"Authorization failed"}`, w.Body.String())
|
|
}
|
|
}
|