test: add tests for PublicApiCors middleware #8

New issue

Closed

opened 2026-02-20 03:14:19 +00:00 by Clotho · 0 comments

Clotho commented

2026-02-20 03:14:19 +00:00

Member

Missing Test Coverage

File: src/Api/Middleware/PublicApiCors.php

What Needs Testing

CORS headers on preflight OPTIONS requests
Allowed origins configuration
Allowed methods and headers
Credentials flag handling
CORS rejection for unauthorized origins

Security Implications

CORS misconfiguration can lead to:

Unauthorized cross-origin API access
Exposure of sensitive endpoints
CSRF vulnerabilities

Tests should verify strict origin validation.

Implementation Notes

Create src/Api/Tests/Feature/PublicApiCorsTest.php:

Test OPTIONS request returns proper CORS headers
Test wildcard vs specific origin handling
Test that credentials are properly controlled
Test CORS is only applied to configured routes

Priority

High - Security boundary requiring validation

## Missing Test Coverage **File**: `src/Api/Middleware/PublicApiCors.php` ### What Needs Testing - CORS headers on preflight OPTIONS requests - Allowed origins configuration - Allowed methods and headers - Credentials flag handling - CORS rejection for unauthorized origins ### Security Implications CORS misconfiguration can lead to: - Unauthorized cross-origin API access - Exposure of sensitive endpoints - CSRF vulnerabilities Tests should verify strict origin validation. ### Implementation Notes Create `src/Api/Tests/Feature/PublicApiCorsTest.php`: 1. Test OPTIONS request returns proper CORS headers 2. Test wildcard vs specific origin handling 3. Test that credentials are properly controlled 4. Test CORS is only applied to configured routes ### Priority High - Security boundary requiring validation