From 9666676766bf21364f4fc4d0d1d336e72f2a91b4 Mon Sep 17 00:00:00 2001 From: historia <[not public]> Date: Tue, 6 Oct 2026 12:57:23 -0400 Subject: refactor: split casino.go, dedup helpers, remove audit docs --- internal/net/web_test.go | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) (limited to 'internal/net/web_test.go') diff --git a/internal/net/web_test.go b/internal/net/web_test.go index d16b31a..20bf7c8 100644 --- a/internal/net/web_test.go +++ b/internal/net/web_test.go @@ -10,8 +10,9 @@ import ( ) // The browser transport previously had no tests. CheckOrigin is the security -// boundary for the /ws upgrade; test it directly with a non-loopback peer so -// the loopback bypass does not mask a hostile Origin. +// boundary for the /ws upgrade; test it directly, including a loopback peer: +// being on the server host must not re-open the cross-site WebSocket hole for +// a hostile browser. func TestWebSocketCheckOrigin(t *testing.T) { cases := []struct { name string @@ -25,7 +26,7 @@ func TestWebSocketCheckOrigin(t *testing.T) { {"same host https", "https://mud.example:4000", "mud.example:4000", "203.0.113.5:1234", true}, {"same hostname no port", "http://mud.example", "mud.example:4000", "203.0.113.5:1234", true}, {"hostile origin", "http://evil.example", "mud.example:4000", "203.0.113.5:1234", false}, - {"loopback bypass", "http://evil.example", "mud.example:4000", "127.0.0.1:1234", true}, + {"loopback hostile origin", "http://evil.example", "mud.example:4000", "127.0.0.1:1234", false}, } for _, tc := range cases { t.Run(tc.name, func(t *testing.T) { @@ -41,7 +42,8 @@ func TestWebSocketCheckOrigin(t *testing.T) { } // The /ws upgrade wires a live session and writer. Drive it end-to-end over a -// real HTTP test server (loopback, so the origin check passes). +// real HTTP test server (the dialer sends no Origin header, which CheckOrigin +// accepts). func TestWebSocketUpgradeAccepted(t *testing.T) { s := &Server{hub: NewHub()} done := make(chan struct{}) -- cgit v1.2.3