fix

2026-08-13 21:01:49 +02:00
parent 593edf35fe
commit 58578fd010
5 changed files with 69 additions and 9 deletions
@@ -137,6 +137,18 @@ func TestCORSAllowsConfiguredOriginOnly(t *testing.T) {
 		t.Fatalf("allow credentials = %q", got)
 	}

+	get := httptest.NewRecorder()
+	reqGet := httptest.NewRequest(http.MethodGet, "/api/auth/me", nil)
+	reqGet.Header.Set("Origin", "http://localhost:5174")
+	h.ServeHTTP(get, reqGet)
+	exposed := get.Header().Get("Access-Control-Expose-Headers")
+	if !strings.Contains(strings.ToLower(exposed), "x-csrf-token") {
+		t.Fatalf("expose headers = %q, want X-CSRF-Token", exposed)
+	}
+	if tok := get.Header().Get("X-CSRF-Token"); tok == "" {
+		t.Fatal("expected X-CSRF-Token on credentialed GET (SPA cross-origin seed)")
+	}
+
 	twin := httptest.NewRecorder()
 	reqTwin := httptest.NewRequest(http.MethodOptions, "/api/auth/login", nil)
 	reqTwin.Header.Set("Origin", "http://127.0.0.1:5174")