secure_headers 3.0.3 → 4.0.0

data/spec/lib/secure_headers_spec.rb

@@ -1,58 +1,93 @@
-require 'spec_helper'
+# frozen_string_literal: true
+require "spec_helper"
 
 module SecureHeaders
   describe SecureHeaders do
-    example_hpkp_config = {
-      max_age: 1_000_000,
-      include_subdomains: true,
-      report_uri: '//example.com/uri-directive',
-      pins: [
-        { sha256: 'abc' },
-        { sha256: '123' }
-      ]
-    }
-
-    example_hpkp_config_value = %(max-age=1000000; pin-sha256="abc"; pin-sha256="123"; report-uri="//example.com/uri-directive"; includeSubDomains)
-
     before(:each) do
       reset_config
-      @request = Rack::Request.new("HTTP_X_FORWARDED_SSL" => "on")
     end
 
+    let(:request) { Rack::Request.new("HTTP_X_FORWARDED_SSL" => "on") }
+
     it "raises a NotYetConfiguredError if default has not been set" do
       expect do
-        SecureHeaders.header_hash_for(@request)
+        SecureHeaders.header_hash_for(request)
       end.to raise_error(Configuration::NotYetConfiguredError)
     end
 
     it "raises a NotYetConfiguredError if trying to opt-out of unconfigured headers" do
       expect do
-        SecureHeaders.opt_out_of_header(@request, CSP::CONFIG_KEY)
+        SecureHeaders.opt_out_of_header(request, ContentSecurityPolicyConfig::CONFIG_KEY)
       end.to raise_error(Configuration::NotYetConfiguredError)
     end
 
-    describe "#header_hash_for" do
-      it "allows you to opt out of individual headers" do
+    it "raises and ArgumentError when referencing an override that has not been set" do
+      expect do
         Configuration.default
-        SecureHeaders.opt_out_of_header(@request, CSP::CONFIG_KEY)
-        hash = SecureHeaders.header_hash_for(@request)
-        expect(hash['Content-Security-Policy-Report-Only']).to be_nil
-        expect(hash['Content-Security-Policy']).to be_nil
+        SecureHeaders.use_secure_headers_override(request, :missing)
+      end.to raise_error(ArgumentError)
+    end
+
+    describe "#header_hash_for" do
+      it "allows you to opt out of individual headers via API" do
+        Configuration.default do |config|
+          config.csp = { default_src: %w('self'), script_src: %w('self')}
+          config.csp_report_only = config.csp
+        end
+        SecureHeaders.opt_out_of_header(request, ContentSecurityPolicyConfig::CONFIG_KEY)
+        SecureHeaders.opt_out_of_header(request, ContentSecurityPolicyReportOnlyConfig::CONFIG_KEY)
+        SecureHeaders.opt_out_of_header(request, XContentTypeOptions::CONFIG_KEY)
+        hash = SecureHeaders.header_hash_for(request)
+        expect(hash["Content-Security-Policy-Report-Only"]).to be_nil
+        expect(hash["Content-Security-Policy"]).to be_nil
+        expect(hash["X-Content-Type-Options"]).to be_nil
+      end
+
+      it "Carries options over when using overrides" do
+        Configuration.default do |config|
+          config.x_download_options = OPT_OUT
+          config.x_permitted_cross_domain_policies = OPT_OUT
+        end
+
+        Configuration.override(:api) do |config|
+          config.x_frame_options = OPT_OUT
+        end
+
+        SecureHeaders.use_secure_headers_override(request, :api)
+        hash = SecureHeaders.header_hash_for(request)
+        expect(hash["X-Download-Options"]).to be_nil
+        expect(hash["X-Permitted-Cross-Domain-Policies"]).to be_nil
+        expect(hash["X-Frame-Options"]).to be_nil
       end
 
       it "allows you to opt out entirely" do
-        Configuration.default
-        SecureHeaders.opt_out_of_all_protection(@request)
-        hash = SecureHeaders.header_hash_for(@request)
+        # configure the disabled-by-default headers to ensure they also do not get set
+        Configuration.default do |config|
+          config.csp = { default_src: ["example.com"], script_src: %w('self') }
+          config.csp_report_only = config.csp
+          config.hpkp = {
+            report_only: false,
+            max_age: 10000000,
+            include_subdomains: true,
+            report_uri: "https://report-uri.io/example-hpkp",
+            pins: [
+              {sha256: "abc"},
+              {sha256: "123"}
+            ]
+          }
+        end
+        SecureHeaders.opt_out_of_all_protection(request)
+        hash = SecureHeaders.header_hash_for(request)
         ALL_HEADER_CLASSES.each do |klass|
           expect(hash[klass::CONFIG_KEY]).to be_nil
         end
+        expect(hash.count).to eq(0)
       end
 
       it "allows you to override X-Frame-Options settings" do
         Configuration.default
-        SecureHeaders.override_x_frame_options(@request, XFrameOptions::DENY)
-        hash = SecureHeaders.header_hash_for(@request)
+        SecureHeaders.override_x_frame_options(request, XFrameOptions::DENY)
+        hash = SecureHeaders.header_hash_for(request)
         expect(hash[XFrameOptions::HEADER_NAME]).to eq(XFrameOptions::DENY)
       end
 
@@ -62,17 +97,38 @@ module SecureHeaders
           config.csp = OPT_OUT
         end
 
-        SecureHeaders.override_x_frame_options(@request, XFrameOptions::SAMEORIGIN)
-        SecureHeaders.override_content_security_policy_directives(@request, default_src: %w(https:), script_src: %w('self'))
+        SecureHeaders.override_x_frame_options(request, XFrameOptions::SAMEORIGIN)
+        SecureHeaders.override_content_security_policy_directives(request, default_src: %w(https:), script_src: %w('self'))
 
-        hash = SecureHeaders.header_hash_for(@request)
-        expect(hash[CSP::HEADER_NAME]).to eq("default-src https:; script-src 'self'")
+        hash = SecureHeaders.header_hash_for(request)
+        expect(hash[ContentSecurityPolicyConfig::HEADER_NAME]).to eq("default-src https:; script-src 'self'")
         expect(hash[XFrameOptions::HEADER_NAME]).to eq(XFrameOptions::SAMEORIGIN)
       end
 
+      it "produces a UA-specific CSP when overriding (and busting the cache)" do
+        Configuration.default do |config|
+          config.csp = {
+            default_src: %w('self'),
+            script_src: %w('self'),
+            child_src: %w('self')
+          }
+        end
+        firefox_request = Rack::Request.new(request.env.merge("HTTP_USER_AGENT" => USER_AGENTS[:firefox]))
+
+        # append an unsupported directive
+        SecureHeaders.override_content_security_policy_directives(firefox_request, {plugin_types: %w(flash)})
+        # append a supported directive
+        SecureHeaders.override_content_security_policy_directives(firefox_request, {script_src: %w('self')})
+
+        hash = SecureHeaders.header_hash_for(firefox_request)
+
+        # child-src is translated to frame-src
+        expect(hash[ContentSecurityPolicyConfig::HEADER_NAME]).to eq("default-src 'self'; frame-src 'self'; script-src 'self'")
+      end
+
       it "produces a hash of headers with default config" do
         Configuration.default
-        hash = SecureHeaders.header_hash_for(@request)
+        hash = SecureHeaders.header_hash_for(request)
         expect_default_values(hash)
       end
 
@@ -87,13 +143,25 @@ module SecureHeaders
       it "does not set the HPKP header if request is over HTTP" do
         plaintext_request = Rack::Request.new({})
         Configuration.default do |config|
-          config.hpkp = example_hpkp_config
+          config.hpkp = {
+            max_age: 1_000_000,
+            include_subdomains: true,
+            report_uri: "//example.com/uri-directive",
+            pins: [
+              { sha256: "abc" },
+              { sha256: "123" }
+            ]
+          }
         end
 
         expect(SecureHeaders.header_hash_for(plaintext_request)[PublicKeyPins::HEADER_NAME]).to be_nil
       end
 
       context "content security policy" do
+        let(:chrome_request) {
+          Rack::Request.new(request.env.merge("HTTP_USER_AGENT" => USER_AGENTS[:chrome]))
+        }
+
         it "appends a value to csp directive" do
           Configuration.default do |config|
             config.csp = {
@@ -102,27 +170,99 @@ module SecureHeaders
             }
           end
 
-          SecureHeaders.append_content_security_policy_directives(@request, script_src: %w(anothercdn.com))
-          hash = SecureHeaders.header_hash_for(@request)
-          expect(hash[CSP::HEADER_NAME]).to eq("default-src 'self'; script-src mycdn.com 'unsafe-inline' anothercdn.com")
+          SecureHeaders.append_content_security_policy_directives(request, script_src: %w(anothercdn.com))
+          hash = SecureHeaders.header_hash_for(request)
+          expect(hash[ContentSecurityPolicyConfig::HEADER_NAME]).to eq("default-src 'self'; script-src mycdn.com 'unsafe-inline' anothercdn.com")
+        end
+
+        it "child-src and frame-src must match" do
+          Configuration.default do |config|
+            config.csp = {
+              default_src: %w('self'),
+              frame_src: %w(frame_src.com),
+              script_src: %w('self')
+            }
+          end
+
+          SecureHeaders.append_content_security_policy_directives(chrome_request, child_src: %w(child_src.com))
+
+          expect {
+            SecureHeaders.header_hash_for(chrome_request)
+          }.to raise_error(ArgumentError)
+        end
+
+        it "supports named appends" do
+          Configuration.default do |config|
+            config.csp = {
+              default_src: %w('self'),
+              script_src: %w('self')
+            }
+          end
+
+          Configuration.named_append(:moar_default_sources) do |request|
+            { default_src: %w(https:), style_src: %w('self')}
+          end
+
+          Configuration.named_append(:how_about_a_script_src_too) do |request|
+            { script_src: %w('unsafe-inline')}
+          end
+
+          SecureHeaders.use_content_security_policy_named_append(request, :moar_default_sources)
+          SecureHeaders.use_content_security_policy_named_append(request, :how_about_a_script_src_too)
+          hash = SecureHeaders.header_hash_for(request)
+
+          expect(hash[ContentSecurityPolicyConfig::HEADER_NAME]).to eq("default-src 'self' https:; script-src 'self' 'unsafe-inline'; style-src 'self'")
+        end
+
+        it "appends a nonce to a missing script-src value" do
+          Configuration.default do |config|
+            config.csp = {
+              default_src: %w('self'),
+              script_src: %w('self')
+            }
+          end
+
+          SecureHeaders.content_security_policy_script_nonce(request) # should add the value to the header
+          hash = SecureHeaders.header_hash_for(chrome_request)
+          expect(hash[ContentSecurityPolicyConfig::HEADER_NAME]).to match(/\Adefault-src 'self'; script-src 'self' 'nonce-.*'\z/)
+        end
+
+        it "appends a hash to a missing script-src value" do
+          Configuration.default do |config|
+            config.csp = {
+              default_src: %w('self'),
+              script_src: %w('self')
+            }
+          end
+
+          SecureHeaders.append_content_security_policy_directives(request, script_src: %w('sha256-abc123'))
+          hash = SecureHeaders.header_hash_for(chrome_request)
+          expect(hash[ContentSecurityPolicyConfig::HEADER_NAME]).to match(/\Adefault-src 'self'; script-src 'self' 'sha256-abc123'\z/)
         end
 
         it "overrides individual directives" do
           Configuration.default do |config|
             config.csp = {
-              default_src: %w('self')
+              default_src: %w('self'),
+              script_src: %w('self')
             }
           end
-          SecureHeaders.override_content_security_policy_directives(@request, default_src: %w('none'))
-          hash = SecureHeaders.header_hash_for(@request)
-          expect(hash[CSP::HEADER_NAME]).to eq("default-src 'none'")
+          SecureHeaders.override_content_security_policy_directives(request, default_src: %w('none'))
+          hash = SecureHeaders.header_hash_for(request)
+          expect(hash[ContentSecurityPolicyConfig::HEADER_NAME]).to eq("default-src 'none'; script-src 'self'")
         end
 
         it "overrides non-existant directives" do
-          Configuration.default
-          SecureHeaders.override_content_security_policy_directives(@request, img_src: [ContentSecurityPolicy::DATA_PROTOCOL])
-          hash = SecureHeaders.header_hash_for(@request)
-          expect(hash[CSP::HEADER_NAME]).to eq("default-src https:; img-src data:")
+          Configuration.default do |config|
+            config.csp = {
+              default_src: %w(https:),
+              script_src: %w('self')
+            }
+          end
+          SecureHeaders.override_content_security_policy_directives(request, img_src: [ContentSecurityPolicy::DATA_PROTOCOL])
+          hash = SecureHeaders.header_hash_for(request)
+          expect(hash[ContentSecurityPolicyReportOnlyConfig::HEADER_NAME]).to be_nil
+          expect(hash[ContentSecurityPolicyConfig::HEADER_NAME]).to eq("default-src https:; img-src data:; script-src 'self'")
         end
 
         it "does not append a nonce when the browser does not support it" do
@@ -134,10 +274,10 @@ module SecureHeaders
             }
           end
 
-          request = Rack::Request.new(@request.env.merge("HTTP_USER_AGENT" => USER_AGENTS[:safari5]))
-          nonce = SecureHeaders.content_security_policy_script_nonce(request)
-          hash = SecureHeaders.header_hash_for(request)
-          expect(hash[CSP::HEADER_NAME]).to eq("default-src 'self'; script-src mycdn.com 'unsafe-inline'; style-src 'self'")
+          safari_request = Rack::Request.new(request.env.merge("HTTP_USER_AGENT" => USER_AGENTS[:safari5]))
+          SecureHeaders.content_security_policy_script_nonce(safari_request)
+          hash = SecureHeaders.header_hash_for(safari_request)
+          expect(hash[ContentSecurityPolicyConfig::HEADER_NAME]).to eq("default-src 'self'; script-src mycdn.com 'unsafe-inline'; style-src 'self'")
         end
 
         it "appends a nonce to the script-src when used" do
@@ -149,16 +289,201 @@ module SecureHeaders
             }
           end
 
-          request = Rack::Request.new(@request.env.merge("HTTP_USER_AGENT" => USER_AGENTS[:chrome]))
-          nonce = SecureHeaders.content_security_policy_script_nonce(request)
+          nonce = SecureHeaders.content_security_policy_script_nonce(chrome_request)
 
           # simulate the nonce being used multiple times in a request:
-          SecureHeaders.content_security_policy_script_nonce(request)
-          SecureHeaders.content_security_policy_script_nonce(request)
-          SecureHeaders.content_security_policy_script_nonce(request)
+          SecureHeaders.content_security_policy_script_nonce(chrome_request)
+          SecureHeaders.content_security_policy_script_nonce(chrome_request)
+          SecureHeaders.content_security_policy_script_nonce(chrome_request)
 
-          hash = SecureHeaders.header_hash_for(request)
-          expect(hash['Content-Security-Policy']).to eq("default-src 'self'; script-src mycdn.com 'nonce-#{nonce}'; style-src 'self'")
+          hash = SecureHeaders.header_hash_for(chrome_request)
+          expect(hash["Content-Security-Policy"]).to eq("default-src 'self'; script-src mycdn.com 'nonce-#{nonce}'; style-src 'self'")
+        end
+
+        it "uses a nonce for safari 10+" do
+          Configuration.default do |config|
+            config.csp = {
+              default_src: %w('self'),
+              script_src: %w(mycdn.com)
+            }
+          end
+
+          safari_request = Rack::Request.new(request.env.merge("HTTP_USER_AGENT" => USER_AGENTS[:safari10]))
+          nonce = SecureHeaders.content_security_policy_script_nonce(safari_request)
+          hash = SecureHeaders.header_hash_for(safari_request)
+          expect(hash["Content-Security-Policy"]).to eq("default-src 'self'; script-src mycdn.com 'nonce-#{nonce}'")
+        end
+
+        it "does not support the deprecated `report_only: true` format" do
+          expect {
+            Configuration.default do |config|
+              config.csp = {
+                default_src: %w('self'),
+                report_only: true
+              }
+            end
+          }.to raise_error(ArgumentError)
+        end
+
+        it "Raises an error if csp_report_only is used with `report_only: false`" do
+          expect do
+            Configuration.default do |config|
+              config.csp_report_only = {
+                default_src: %w('self'),
+                script_src: %w('self'),
+                report_only: false
+              }
+            end
+          end.to raise_error(ContentSecurityPolicyConfigError)
+        end
+
+        context "setting two headers" do
+          before(:each) do
+            Configuration.default do |config|
+              config.csp = {
+                default_src: %w('self'),
+                script_src: %w('self')
+              }
+              config.csp_report_only = config.csp
+            end
+          end
+
+          it "sets identical values when the configs are the same" do
+            Configuration.default do |config|
+              config.csp = {
+                default_src: %w('self'),
+                script_src: %w('self')
+              }
+              config.csp_report_only = {
+                default_src: %w('self'),
+                script_src: %w('self')
+              }
+            end
+
+            hash = SecureHeaders.header_hash_for(request)
+            expect(hash["Content-Security-Policy"]).to eq("default-src 'self'; script-src 'self'")
+            expect(hash["Content-Security-Policy-Report-Only"]).to eq("default-src 'self'; script-src 'self'")
+          end
+
+          it "sets different headers when the configs are different" do
+            Configuration.default do |config|
+              config.csp = {
+                default_src: %w('self'),
+                script_src: %w('self')
+              }
+              config.csp_report_only = config.csp.merge({script_src: %w(foo.com)})
+            end
+
+            hash = SecureHeaders.header_hash_for(request)
+            expect(hash["Content-Security-Policy"]).to eq("default-src 'self'; script-src 'self'")
+            expect(hash["Content-Security-Policy-Report-Only"]).to eq("default-src 'self'; script-src 'self' foo.com")
+          end
+
+          it "allows you to opt-out of enforced CSP" do
+            Configuration.default do |config|
+              config.csp = SecureHeaders::OPT_OUT
+              config.csp_report_only = {
+                default_src: %w('self'),
+                script_src: %w('self')
+              }
+            end
+
+            hash = SecureHeaders.header_hash_for(request)
+            expect(hash["Content-Security-Policy"]).to be_nil
+            expect(hash["Content-Security-Policy-Report-Only"]).to eq("default-src 'self'; script-src 'self'")
+          end
+
+          it "allows appending to the enforced policy" do
+            SecureHeaders.append_content_security_policy_directives(request, {script_src: %w(anothercdn.com)}, :enforced)
+            hash = SecureHeaders.header_hash_for(request)
+            expect(hash["Content-Security-Policy"]).to eq("default-src 'self'; script-src 'self' anothercdn.com")
+            expect(hash["Content-Security-Policy-Report-Only"]).to eq("default-src 'self'; script-src 'self'")
+          end
+
+          it "allows appending to the report only policy" do
+            SecureHeaders.append_content_security_policy_directives(request, {script_src: %w(anothercdn.com)}, :report_only)
+            hash = SecureHeaders.header_hash_for(request)
+            expect(hash["Content-Security-Policy"]).to eq("default-src 'self'; script-src 'self'")
+            expect(hash["Content-Security-Policy-Report-Only"]).to eq("default-src 'self'; script-src 'self' anothercdn.com")
+          end
+
+          it "allows appending to both policies" do
+            SecureHeaders.append_content_security_policy_directives(request, {script_src: %w(anothercdn.com)}, :both)
+            hash = SecureHeaders.header_hash_for(request)
+            expect(hash["Content-Security-Policy"]).to eq("default-src 'self'; script-src 'self' anothercdn.com")
+            expect(hash["Content-Security-Policy-Report-Only"]).to eq("default-src 'self'; script-src 'self' anothercdn.com")
+          end
+
+          it "allows overriding the enforced policy" do
+            SecureHeaders.override_content_security_policy_directives(request, {script_src: %w(anothercdn.com)}, :enforced)
+            hash = SecureHeaders.header_hash_for(request)
+            expect(hash["Content-Security-Policy"]).to eq("default-src 'self'; script-src anothercdn.com")
+            expect(hash["Content-Security-Policy-Report-Only"]).to eq("default-src 'self'; script-src 'self'")
+          end
+
+          it "allows overriding the report only policy" do
+            SecureHeaders.override_content_security_policy_directives(request, {script_src: %w(anothercdn.com)}, :report_only)
+            hash = SecureHeaders.header_hash_for(request)
+            expect(hash["Content-Security-Policy"]).to eq("default-src 'self'; script-src 'self'")
+            expect(hash["Content-Security-Policy-Report-Only"]).to eq("default-src 'self'; script-src anothercdn.com")
+          end
+
+          it "allows overriding both policies" do
+            SecureHeaders.override_content_security_policy_directives(request, {script_src: %w(anothercdn.com)}, :both)
+            hash = SecureHeaders.header_hash_for(request)
+            expect(hash["Content-Security-Policy"]).to eq("default-src 'self'; script-src anothercdn.com")
+            expect(hash["Content-Security-Policy-Report-Only"]).to eq("default-src 'self'; script-src anothercdn.com")
+          end
+
+          context "when inferring which config to modify" do
+            it "updates the enforced header when configured" do
+              Configuration.default do |config|
+                config.csp = {
+                  default_src: %w('self'),
+                  script_src: %w('self')
+                }
+              end
+              SecureHeaders.append_content_security_policy_directives(request, {script_src: %w(anothercdn.com)})
+
+              hash = SecureHeaders.header_hash_for(request)
+              expect(hash["Content-Security-Policy"]).to eq("default-src 'self'; script-src 'self' anothercdn.com")
+              expect(hash["Content-Security-Policy-Report-Only"]).to be_nil
+            end
+
+            it "updates the report only header when configured" do
+              Configuration.default do |config|
+                config.csp = OPT_OUT
+                config.csp_report_only = {
+                  default_src: %w('self'),
+                  script_src: %w('self')
+                }
+              end
+              SecureHeaders.append_content_security_policy_directives(request, {script_src: %w(anothercdn.com)})
+
+              hash = SecureHeaders.header_hash_for(request)
+              expect(hash["Content-Security-Policy-Report-Only"]).to eq("default-src 'self'; script-src 'self' anothercdn.com")
+              expect(hash["Content-Security-Policy"]).to be_nil
+            end
+
+            it "updates both headers if both are configured" do
+              Configuration.default do |config|
+                config.csp = {
+                  default_src: %w(enforced.com),
+                  script_src: %w('self')
+                }
+                config.csp_report_only = {
+                  default_src: %w(reportonly.com),
+                  script_src: %w('self')
+                }
+              end
+              SecureHeaders.append_content_security_policy_directives(request, {script_src: %w(anothercdn.com)})
+
+              hash = SecureHeaders.header_hash_for(request)
+              expect(hash["Content-Security-Policy"]).to eq("default-src enforced.com; script-src 'self' anothercdn.com")
+              expect(hash["Content-Security-Policy-Report-Only"]).to eq("default-src reportonly.com; script-src 'self' anothercdn.com")
+            end
+
+          end
         end
       end
     end
@@ -167,7 +492,7 @@ module SecureHeaders
       it "validates your hsts config upon configuration" do
         expect do
           Configuration.default do |config|
-            config.hsts = 'lol'
+            config.hsts = "lol"
           end
         end.to raise_error(STSConfigError)
       end
@@ -175,7 +500,7 @@ module SecureHeaders
       it "validates your csp config upon configuration" do
         expect do
           Configuration.default do |config|
-            config.csp = { CSP::DEFAULT_SRC => '123456' }
+            config.csp = { ContentSecurityPolicy::DEFAULT_SRC => "123456" }
           end
         end.to raise_error(ContentSecurityPolicyConfigError)
       end
@@ -183,7 +508,7 @@ module SecureHeaders
       it "raises errors for unknown directives" do
         expect do
           Configuration.default do |config|
-            config.csp = { made_up_directive: '123456' }
+            config.csp = { made_up_directive: "123456" }
           end
         end.to raise_error(ContentSecurityPolicyConfigError)
       end
@@ -204,6 +529,14 @@ module SecureHeaders
         end.to raise_error(XContentTypeOptionsConfigError)
       end
 
+      it "validates your clear site data config upon configuration" do
+        expect do
+          Configuration.default do |config|
+            config.clear_site_data = 1
+          end
+        end.to raise_error(ClearSiteDataConfigError)
+      end
+
       it "validates your x_xss config upon configuration" do
         expect do
           Configuration.default do |config|
@@ -228,6 +561,14 @@ module SecureHeaders
         end.to raise_error(XPCDPConfigError)
       end
 
+      it "validates your referrer_policy config upon configuration" do
+        expect do
+          Configuration.default do |config|
+            config.referrer_policy = "lol"
+          end
+        end.to raise_error(ReferrerPolicyConfigError)
+      end
+
       it "validates your hpkp config upon configuration" do
         expect do
           Configuration.default do |config|
@@ -235,6 +576,14 @@ module SecureHeaders
           end
         end.to raise_error(PublicKeyPinsConfigError)
       end
+
+      it "validates your cookies config upon configuration" do
+        expect do
+          Configuration.default do |config|
+            config.cookies = { secure: "lol" }
+          end
+        end.to raise_error(CookiesConfigError)
+      end
     end
   end
 end

data/spec/spec_helper.rb

@@ -1,32 +1,39 @@
-require 'rubygems'
-require 'rspec'
-require 'rack'
-require 'pry-nav'
+# frozen_string_literal: true
+require "rubygems"
+require "rspec"
+require "rack"
+require "coveralls"
+Coveralls.wear!
+
+require File.join(File.dirname(__FILE__), "..", "lib", "secure_headers")
 
-require File.join(File.dirname(__FILE__), '..', 'lib', 'secure_headers')
 
-ENV["RAILS_ENV"] = "test"
 
 USER_AGENTS = {
-  firefox: 'Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:14.0) Gecko/20100101 Firefox/14.0.1',
-  chrome: 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.56 Safari/536.5',
-  ie: 'Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0)',
-  opera: 'Opera/9.80 (Windows NT 6.1; U; es-ES) Presto/2.9.181 Version/12.00',
+  edge: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.246",
+  firefox: "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:14.0) Gecko/20100101 Firefox/14.0.1",
+  firefox46: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:46.0) Gecko/20100101 Firefox/46.0",
+  chrome: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_6_8) AppleWebKit/536.5 (KHTML, like Gecko) Chrome/19.0.1084.56 Safari/536.5",
+  ie: "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/5.0)",
+  opera: "Opera/9.80 (Windows NT 6.1; U; es-ES) Presto/2.9.181 Version/12.00",
   ios5: "Mozilla/5.0 (iPhone; CPU iPhone OS 5_0 like Mac OS X) AppleWebKit/534.46 (KHTML, like Gecko) Version/5.1 Mobile/9A334 Safari/7534.48.3",
   ios6: "Mozilla/5.0 (iPhone; CPU iPhone OS 614 like Mac OS X) AppleWebKit/536.26 (KHTML like Gecko) Version/6.0 Mobile/10B350 Safari/8536.25",
   safari5: "Mozilla/5.0 (iPad; CPU OS 5_1 like Mac OS X) AppleWebKit/534.46 (KHTML, like Gecko ) Version/5.1 Mobile/9B176 Safari/7534.48.3",
   safari5_1: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_3) AppleWebKit/534.55.3 (KHTML, like Gecko) Version/5.1.3 Safari/534.53.10",
-  safari6: "Mozilla/5.0 (Macintosh; Intel Mac OS X 1084) AppleWebKit/536.30.1 (KHTML like Gecko) Version/6.0.5 Safari/536.30.1"
+  safari6: "Mozilla/5.0 (Macintosh; Intel Mac OS X 1084) AppleWebKit/536.30.1 (KHTML like Gecko) Version/6.0.5 Safari/536.30.1",
+  safari10: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_1) AppleWebKit/602.2.11 (KHTML, like Gecko) Version/10.0.1 Safari/602.2.11"
 }
 
 def expect_default_values(hash)
-  expect(hash[SecureHeaders::CSP::HEADER_NAME]).to eq(SecureHeaders::CSP::DEFAULT_VALUE)
+  expect(hash[SecureHeaders::ContentSecurityPolicyConfig::HEADER_NAME]).to eq("default-src 'self' https:; font-src 'self' https: data:; img-src 'self' https: data:; object-src 'none'; script-src https:; style-src 'self' https: 'unsafe-inline'")
   expect(hash[SecureHeaders::XFrameOptions::HEADER_NAME]).to eq(SecureHeaders::XFrameOptions::DEFAULT_VALUE)
   expect(hash[SecureHeaders::XDownloadOptions::HEADER_NAME]).to eq(SecureHeaders::XDownloadOptions::DEFAULT_VALUE)
   expect(hash[SecureHeaders::StrictTransportSecurity::HEADER_NAME]).to eq(SecureHeaders::StrictTransportSecurity::DEFAULT_VALUE)
   expect(hash[SecureHeaders::XXssProtection::HEADER_NAME]).to eq(SecureHeaders::XXssProtection::DEFAULT_VALUE)
   expect(hash[SecureHeaders::XContentTypeOptions::HEADER_NAME]).to eq(SecureHeaders::XContentTypeOptions::DEFAULT_VALUE)
   expect(hash[SecureHeaders::XPermittedCrossDomainPolicies::HEADER_NAME]).to eq(SecureHeaders::XPermittedCrossDomainPolicies::DEFAULT_VALUE)
+  expect(hash[SecureHeaders::ReferrerPolicy::HEADER_NAME]).to be_nil
+  expect(hash[SecureHeaders::ExpectCertificateTransparency::HEADER_NAME]).to be_nil
 end
 
 module SecureHeaders