1
|
|
|
<?php |
2
|
|
|
use CheatCodes\GuzzleHsts\ArrayStore; |
3
|
|
|
use CheatCodes\GuzzleHsts\HstsMiddleware; |
4
|
|
|
use GuzzleHttp\Client; |
5
|
|
|
use GuzzleHttp\Handler\MockHandler; |
6
|
|
|
use GuzzleHttp\HandlerStack; |
7
|
|
|
use GuzzleHttp\Middleware; |
8
|
|
|
use GuzzleHttp\Psr7\Response; |
9
|
|
|
use PHPUnit\Framework\TestCase; |
10
|
|
|
|
11
|
|
|
class MiddlewareTest extends TestCase |
12
|
|
|
{ |
13
|
|
|
public function testWithHeaderOverHttp() |
14
|
|
|
{ |
15
|
|
|
$container = []; |
16
|
|
|
|
17
|
|
|
$mock = new MockHandler([ |
18
|
|
|
new Response(200, ['Strict-Transport-Security' => 'max-age=31536000']), |
19
|
|
|
new Response(200, ['Strict-Transport-Security' => 'max-age=31536000']), |
20
|
|
|
]); |
21
|
|
|
|
22
|
|
|
$handler = HandlerStack::create($mock); |
23
|
|
|
|
24
|
|
|
$handler->push(HstsMiddleware::handler()); |
25
|
|
|
$handler->push(Middleware::history($container)); |
26
|
|
|
|
27
|
|
|
$client = new Client(['handler' => $handler]); |
28
|
|
|
|
29
|
|
|
$client->request('GET', 'http://example.com/'); |
30
|
|
|
|
31
|
|
|
$client->request('GET', 'http://example.com/'); |
32
|
|
|
|
33
|
|
|
$this->assertCount(2, $container); |
34
|
|
|
|
35
|
|
|
/** @var \GuzzleHttp\Psr7\Request $request */ |
36
|
|
|
$request = $container[1]['request']; |
37
|
|
|
|
38
|
|
|
$this->assertEquals('http', $request->getUri()->getScheme()); |
39
|
|
|
} |
40
|
|
|
|
41
|
|
|
public function testWithHeaderOverHttps() |
42
|
|
|
{ |
43
|
|
|
$container = []; |
44
|
|
|
|
45
|
|
|
$mock = new MockHandler([ |
46
|
|
|
new Response(200, ['Strict-Transport-Security' => 'max-age=31536000']), |
47
|
|
|
new Response(200, ['Strict-Transport-Security' => 'max-age=31536000']), |
48
|
|
|
]); |
49
|
|
|
|
50
|
|
|
$handler = HandlerStack::create($mock); |
51
|
|
|
|
52
|
|
|
$handler->push(HstsMiddleware::handler()); |
53
|
|
|
$handler->push(Middleware::history($container)); |
54
|
|
|
|
55
|
|
|
$client = new Client(['handler' => $handler]); |
56
|
|
|
|
57
|
|
|
$client->request('GET', 'https://example.com/'); |
58
|
|
|
|
59
|
|
|
$client->request('GET', 'http://example.com/'); |
60
|
|
|
|
61
|
|
|
$this->assertCount(2, $container); |
62
|
|
|
|
63
|
|
|
/** @var \GuzzleHttp\Psr7\Request $request */ |
64
|
|
|
$request = $container[1]['request']; |
65
|
|
|
|
66
|
|
|
$this->assertEquals('https', $request->getUri()->getScheme()); |
67
|
|
|
} |
68
|
|
|
|
69
|
|
|
public function testWithoutHeader() |
70
|
|
|
{ |
71
|
|
|
$container = []; |
72
|
|
|
|
73
|
|
|
$mock = new MockHandler([ |
74
|
|
|
new Response(200), |
75
|
|
|
new Response(200), |
76
|
|
|
]); |
77
|
|
|
|
78
|
|
|
$handler = HandlerStack::create($mock); |
79
|
|
|
|
80
|
|
|
$handler->push(HstsMiddleware::handler()); |
81
|
|
|
$handler->push(Middleware::history($container)); |
82
|
|
|
|
83
|
|
|
$client = new Client(['handler' => $handler]); |
84
|
|
|
|
85
|
|
|
$client->request('GET', 'https://example.com/'); |
86
|
|
|
|
87
|
|
|
$client->request('GET', 'http://example.com/'); |
88
|
|
|
|
89
|
|
|
$this->assertCount(2, $container); |
90
|
|
|
|
91
|
|
|
/** @var \GuzzleHttp\Psr7\Request $request */ |
92
|
|
|
$request = $container[1]['request']; |
93
|
|
|
|
94
|
|
|
$this->assertEquals('http', $request->getUri()->getScheme()); |
95
|
|
|
} |
96
|
|
|
|
97
|
|
|
public function testWithRedirect() |
98
|
|
|
{ |
99
|
|
|
$container = []; |
100
|
|
|
|
101
|
|
|
$mock = new MockHandler([ |
102
|
|
|
new Response(301, ['Location' => 'https://example.com']), |
103
|
|
|
new Response(200, ['Strict-Transport-Security' => 'max-age=31536000']), |
104
|
|
|
new Response(200, ['Strict-Transport-Security' => 'max-age=31536000']), |
105
|
|
|
]); |
106
|
|
|
|
107
|
|
|
$handler = HandlerStack::create($mock); |
108
|
|
|
|
109
|
|
|
$handler->push(HstsMiddleware::handler()); |
110
|
|
|
$handler->push(Middleware::history($container)); |
111
|
|
|
|
112
|
|
|
$client = new Client(['handler' => $handler]); |
113
|
|
|
|
114
|
|
|
$client->request('GET', 'http://example.com/'); |
115
|
|
|
|
116
|
|
|
$client->request('GET', 'http://example.com/'); |
117
|
|
|
|
118
|
|
|
$this->assertCount(3, $container); |
119
|
|
|
|
120
|
|
|
/** @var \GuzzleHttp\Psr7\Request $request */ |
121
|
|
|
$request = $container[2]['request']; |
122
|
|
|
|
123
|
|
|
$this->assertEquals('https', $request->getUri()->getScheme()); |
124
|
|
|
} |
125
|
|
|
|
126
|
|
|
public function testIncludeSubDomains() |
127
|
|
|
{ |
128
|
|
|
$container = []; |
129
|
|
|
|
130
|
|
|
$mock = new MockHandler([ |
131
|
|
|
new Response(200, ['Strict-Transport-Security' => 'max-age=31536000; includeSubDomains']), |
132
|
|
|
new Response(200), |
133
|
|
|
new Response(200), |
134
|
|
|
]); |
135
|
|
|
|
136
|
|
|
$handler = HandlerStack::create($mock); |
137
|
|
|
|
138
|
|
|
$handler->push(HstsMiddleware::handler()); |
139
|
|
|
$handler->push(Middleware::history($container)); |
140
|
|
|
|
141
|
|
|
$client = new Client(['handler' => $handler]); |
142
|
|
|
|
143
|
|
|
$client->request('GET', 'https://example.com/'); |
144
|
|
|
|
145
|
|
|
$client->request('GET', 'http://example.com/'); |
146
|
|
|
|
147
|
|
|
$client->request('GET', 'http://foobar.example.com/'); |
148
|
|
|
|
149
|
|
|
$this->assertCount(3, $container); |
150
|
|
|
|
151
|
|
|
/** @var \GuzzleHttp\Psr7\Request $request */ |
152
|
|
|
$request = $container[1]['request']; |
153
|
|
|
|
154
|
|
|
$this->assertEquals('https', $request->getUri()->getScheme()); |
155
|
|
|
|
156
|
|
|
/** @var \GuzzleHttp\Psr7\Request $request */ |
157
|
|
|
$request = $container[2]['request']; |
158
|
|
|
|
159
|
|
|
$this->assertEquals('https', $request->getUri()->getScheme()); |
160
|
|
|
} |
161
|
|
|
|
162
|
|
|
public function testIncludeSubDomainsFromSub() |
163
|
|
|
{ |
164
|
|
|
$container = []; |
165
|
|
|
|
166
|
|
|
$mock = new MockHandler([ |
167
|
|
|
new Response(200, ['Strict-Transport-Security' => 'max-age=31536000; includeSubDomains']), |
168
|
|
|
new Response(200), |
169
|
|
|
new Response(200), |
170
|
|
|
new Response(200), |
171
|
|
|
]); |
172
|
|
|
|
173
|
|
|
$handler = HandlerStack::create($mock); |
174
|
|
|
|
175
|
|
|
$handler->push(HstsMiddleware::handler()); |
176
|
|
|
$handler->push(Middleware::history($container)); |
177
|
|
|
|
178
|
|
|
$client = new Client(['handler' => $handler]); |
179
|
|
|
|
180
|
|
|
$client->request('GET', 'https://bar.example.com/'); |
181
|
|
|
|
182
|
|
|
$client->request('GET', 'http://bar.example.com/'); |
183
|
|
|
|
184
|
|
|
$client->request('GET', 'http://foo.bar.example.com/'); |
185
|
|
|
|
186
|
|
|
$client->request('GET', 'http://example.com/'); |
187
|
|
|
|
188
|
|
|
$this->assertCount(4, $container); |
189
|
|
|
|
190
|
|
|
/** @var \GuzzleHttp\Psr7\Request $request */ |
191
|
|
|
$request = $container[1]['request']; |
192
|
|
|
|
193
|
|
|
$this->assertEquals('https', $request->getUri()->getScheme()); |
194
|
|
|
|
195
|
|
|
/** @var \GuzzleHttp\Psr7\Request $request */ |
196
|
|
|
$request = $container[2]['request']; |
197
|
|
|
|
198
|
|
|
$this->assertEquals('https', $request->getUri()->getScheme()); |
199
|
|
|
|
200
|
|
|
/** @var \GuzzleHttp\Psr7\Request $request */ |
201
|
|
|
$request = $container[3]['request']; |
202
|
|
|
|
203
|
|
|
$this->assertEquals('http', $request->getUri()->getScheme()); |
204
|
|
|
} |
205
|
|
|
|
206
|
|
|
public function testIpAddressHost() |
207
|
|
|
{ |
208
|
|
|
$container = []; |
209
|
|
|
|
210
|
|
|
$mock = new MockHandler([ |
211
|
|
|
new Response(200, ['Strict-Transport-Security' => 'max-age=31536000']), |
212
|
|
|
new Response(200), |
213
|
|
|
]); |
214
|
|
|
|
215
|
|
|
$handler = HandlerStack::create($mock); |
216
|
|
|
|
217
|
|
|
$handler->push(HstsMiddleware::handler()); |
218
|
|
|
$handler->push(Middleware::history($container)); |
219
|
|
|
|
220
|
|
|
$client = new Client(['handler' => $handler]); |
221
|
|
|
|
222
|
|
|
$client->request('GET', 'https://127.0.0.1/'); |
223
|
|
|
|
224
|
|
|
$client->request('GET', 'http://127.0.0.1/'); |
225
|
|
|
|
226
|
|
|
$this->assertCount(2, $container); |
227
|
|
|
|
228
|
|
|
/** @var \GuzzleHttp\Psr7\Request $request */ |
229
|
|
|
$request = $container[1]['request']; |
230
|
|
|
|
231
|
|
|
$this->assertEquals('http', $request->getUri()->getScheme()); |
232
|
|
|
} |
233
|
|
|
|
234
|
|
|
public function testExpired() |
235
|
|
|
{ |
236
|
|
|
$container = []; |
237
|
|
|
|
238
|
|
|
$mock = new MockHandler([ |
239
|
|
|
new Response(200, ['Strict-Transport-Security' => 'max-age=3']), |
240
|
|
|
new Response(200), |
241
|
|
|
new Response(200), |
242
|
|
|
]); |
243
|
|
|
|
244
|
|
|
$handler = HandlerStack::create($mock); |
245
|
|
|
|
246
|
|
|
$handler->push(HstsMiddleware::handler()); |
247
|
|
|
$handler->push(Middleware::history($container)); |
248
|
|
|
|
249
|
|
|
$client = new Client(['handler' => $handler]); |
250
|
|
|
|
251
|
|
|
$client->request('GET', 'https://example.com/'); |
252
|
|
|
|
253
|
|
|
$client->request('GET', 'http://example.com/'); |
254
|
|
|
|
255
|
|
|
sleep(4); |
256
|
|
|
|
257
|
|
|
$client->request('GET', 'http://example.com/'); |
258
|
|
|
|
259
|
|
|
$this->assertCount(3, $container); |
260
|
|
|
|
261
|
|
|
/** @var \GuzzleHttp\Psr7\Request $request */ |
262
|
|
|
$request = $container[1]['request']; |
263
|
|
|
|
264
|
|
|
$this->assertEquals('https', $request->getUri()->getScheme()); |
265
|
|
|
|
266
|
|
|
/** @var \GuzzleHttp\Psr7\Request $request */ |
267
|
|
|
$request = $container[2]['request']; |
268
|
|
|
|
269
|
|
|
$this->assertEquals('http', $request->getUri()->getScheme()); |
270
|
|
|
} |
271
|
|
|
|
272
|
|
|
public function testMultipleHeaders() |
273
|
|
|
{ |
274
|
|
|
$container = []; |
275
|
|
|
|
276
|
|
|
$mock = new MockHandler([ |
277
|
|
|
new Response(200, ['Strict-Transport-Security' => ['max-age=31536000', 'max-age=0']]), |
278
|
|
|
new Response(200), |
279
|
|
|
]); |
280
|
|
|
|
281
|
|
|
$handler = HandlerStack::create($mock); |
282
|
|
|
|
283
|
|
|
$handler->push(HstsMiddleware::handler()); |
284
|
|
|
$handler->push(Middleware::history($container)); |
285
|
|
|
|
286
|
|
|
$client = new Client(['handler' => $handler]); |
287
|
|
|
|
288
|
|
|
$client->request('GET', 'https://example.com/'); |
289
|
|
|
|
290
|
|
|
$client->request('GET', 'http://example.com/'); |
291
|
|
|
|
292
|
|
|
$this->assertCount(2, $container); |
293
|
|
|
|
294
|
|
|
/** @var \GuzzleHttp\Psr7\Request $request */ |
295
|
|
|
$request = $container[1]['request']; |
296
|
|
|
|
297
|
|
|
$this->assertEquals('https', $request->getUri()->getScheme()); |
298
|
|
|
} |
299
|
|
|
|
300
|
|
|
public function testMaxAge0() |
301
|
|
|
{ |
302
|
|
|
$container = []; |
303
|
|
|
|
304
|
|
|
$mock = new MockHandler([ |
305
|
|
|
new Response(200, ['Strict-Transport-Security' => 'max-age=31536000']), |
306
|
|
|
new Response(200, ['Strict-Transport-Security' => 'max-age=0']), |
307
|
|
|
new Response(200), |
308
|
|
|
]); |
309
|
|
|
|
310
|
|
|
$handler = HandlerStack::create($mock); |
311
|
|
|
|
312
|
|
|
$handler->push(HstsMiddleware::handler()); |
313
|
|
|
$handler->push(Middleware::history($container)); |
314
|
|
|
|
315
|
|
|
$client = new Client(['handler' => $handler]); |
316
|
|
|
|
317
|
|
|
// Set HSTS |
318
|
|
|
$client->request('GET', 'https://example.com/'); |
319
|
|
|
|
320
|
|
|
// Set HSTS to 0 |
321
|
|
|
$client->request('GET', 'http://example.com/'); |
322
|
|
|
|
323
|
|
|
$client->request('GET', 'http://example.com/'); |
324
|
|
|
|
325
|
|
|
$this->assertCount(3, $container); |
326
|
|
|
|
327
|
|
|
/** @var \GuzzleHttp\Psr7\Request $request */ |
328
|
|
|
$request = $container[1]['request']; |
329
|
|
|
|
330
|
|
|
$this->assertEquals('https', $request->getUri()->getScheme()); |
331
|
|
|
|
332
|
|
|
/** @var \GuzzleHttp\Psr7\Request $request */ |
333
|
|
|
$request = $container[2]['request']; |
334
|
|
|
|
335
|
|
|
$this->assertEquals('http', $request->getUri()->getScheme()); |
336
|
|
|
} |
337
|
|
|
|
338
|
|
|
public function testInvalidHeader() |
339
|
|
|
{ |
340
|
|
|
$container = []; |
341
|
|
|
|
342
|
|
|
$mock = new MockHandler([ |
343
|
|
|
new Response(200, ['Strict-Transport-Security' => 'foobar']), |
344
|
|
|
new Response(200), |
345
|
|
|
]); |
346
|
|
|
|
347
|
|
|
$handler = HandlerStack::create($mock); |
348
|
|
|
|
349
|
|
|
$handler->push(HstsMiddleware::handler()); |
350
|
|
|
$handler->push(Middleware::history($container)); |
351
|
|
|
|
352
|
|
|
$client = new Client(['handler' => $handler]); |
353
|
|
|
|
354
|
|
|
$client->request('GET', 'https://example.com/'); |
355
|
|
|
|
356
|
|
|
$client->request('GET', 'http://example.com/'); |
357
|
|
|
|
358
|
|
|
$this->assertCount(2, $container); |
359
|
|
|
|
360
|
|
|
/** @var \GuzzleHttp\Psr7\Request $request */ |
361
|
|
|
$request = $container[1]['request']; |
362
|
|
|
|
363
|
|
|
$this->assertEquals('http', $request->getUri()->getScheme()); |
364
|
|
|
} |
365
|
|
|
|
366
|
|
|
public function testInvalidHeaderNoMaxAge() |
367
|
|
|
{ |
368
|
|
|
$container = []; |
369
|
|
|
|
370
|
|
|
$mock = new MockHandler([ |
371
|
|
|
new Response(200, ['Strict-Transport-Security' => 'includeSubDomains; preload']), |
372
|
|
|
new Response(200), |
373
|
|
|
]); |
374
|
|
|
|
375
|
|
|
$handler = HandlerStack::create($mock); |
376
|
|
|
|
377
|
|
|
$handler->push(HstsMiddleware::handler()); |
378
|
|
|
$handler->push(Middleware::history($container)); |
379
|
|
|
|
380
|
|
|
$client = new Client(['handler' => $handler]); |
381
|
|
|
|
382
|
|
|
$client->request('GET', 'https://example.com/'); |
383
|
|
|
|
384
|
|
|
$client->request('GET', 'http://example.com/'); |
385
|
|
|
|
386
|
|
|
$this->assertCount(2, $container); |
387
|
|
|
|
388
|
|
|
/** @var \GuzzleHttp\Psr7\Request $request */ |
389
|
|
|
$request = $container[1]['request']; |
390
|
|
|
|
391
|
|
|
$this->assertEquals('http', $request->getUri()->getScheme()); |
392
|
|
|
} |
393
|
|
|
|
394
|
|
|
public function testStoreInstance() |
395
|
|
|
{ |
396
|
|
|
$container = []; |
397
|
|
|
|
398
|
|
|
$mock = new MockHandler([ |
399
|
|
|
new Response(200, ['Strict-Transport-Security' => 'max-age=31536000']), |
400
|
|
|
new Response(200, ['Strict-Transport-Security' => 'max-age=31536000']), |
401
|
|
|
]); |
402
|
|
|
|
403
|
|
|
$handler = HandlerStack::create($mock); |
404
|
|
|
|
405
|
|
|
$handler->push(HstsMiddleware::handler()); |
406
|
|
|
$handler->push(Middleware::history($container)); |
407
|
|
|
|
408
|
|
|
$client = new Client([ |
409
|
|
|
'handler' => $handler, |
410
|
|
|
'hsts_store' => new ArrayStore(), |
411
|
|
|
]); |
412
|
|
|
|
413
|
|
|
$client->request('GET', 'https://example.com/'); |
414
|
|
|
|
415
|
|
|
$client->request('GET', 'http://example.com/'); |
416
|
|
|
|
417
|
|
|
$this->assertCount(2, $container); |
418
|
|
|
|
419
|
|
|
/** @var \GuzzleHttp\Psr7\Request $request */ |
420
|
|
|
$request = $container[1]['request']; |
421
|
|
|
|
422
|
|
|
$this->assertEquals('https', $request->getUri()->getScheme()); |
423
|
|
|
} |
424
|
|
|
|
425
|
|
|
public function testStoreClass() |
426
|
|
|
{ |
427
|
|
|
$container = []; |
428
|
|
|
|
429
|
|
|
$mock = new MockHandler([ |
430
|
|
|
new Response(200, ['Strict-Transport-Security' => 'max-age=31536000']), |
431
|
|
|
new Response(200, ['Strict-Transport-Security' => 'max-age=31536000']), |
432
|
|
|
]); |
433
|
|
|
|
434
|
|
|
$handler = HandlerStack::create($mock); |
435
|
|
|
|
436
|
|
|
$handler->push(HstsMiddleware::handler()); |
437
|
|
|
$handler->push(Middleware::history($container)); |
438
|
|
|
|
439
|
|
|
$client = new Client([ |
440
|
|
|
'handler' => $handler, |
441
|
|
|
'hsts_store' => ArrayStore::class, |
442
|
|
|
]); |
443
|
|
|
|
444
|
|
|
$client->request('GET', 'https://example.com/'); |
445
|
|
|
|
446
|
|
|
$client->request('GET', 'http://example.com/'); |
447
|
|
|
|
448
|
|
|
$this->assertCount(2, $container); |
449
|
|
|
|
450
|
|
|
/** @var \GuzzleHttp\Psr7\Request $request */ |
451
|
|
|
$request = $container[1]['request']; |
452
|
|
|
|
453
|
|
|
$this->assertEquals('https', $request->getUri()->getScheme()); |
454
|
|
|
} |
455
|
|
|
} |
456
|
|
|
|