Commit Graph

17 Commits

Author SHA1 Message Date
Shaun Hamilton
916e22fd6b
fix(api): allow coderoad and exam env headers (#56619) 2024-10-09 10:06:53 -07:00
Oliver Eyton-Williams
ced457fed5
refactor: move CSRF code into plugin (#56447) 2024-10-04 12:56:04 +00:00
Oliver Eyton-Williams
fbf28bbb4c
fix(api): remove / handler (#55428) 2024-07-05 20:50:53 -07:00
Oliver Eyton-Williams
84a81c842b
fix(api): remove cookie domain in development (#54518) 2024-04-26 08:32:46 -07:00
Oliver Eyton-Williams
9f71d1c3ac
test: stop mocking env vars in jest.utils (#53985) 2024-03-07 08:36:06 +01:00
Oliver Eyton-Williams
58539ce080
refactor(api): DRY tests (#51776) 2023-10-03 21:44:25 +07:00
Muhammed Mustafa
49b728d31b
refactor: disable naming-convenction rule (#51685) 2023-09-30 20:23:39 +07:00
Oliver Eyton-Williams
2b5bc585a3
feat(api): sync api and api-server CORS headers (#51608) 2023-09-21 15:40:19 +02:00
Oliver Eyton-Williams
c3c912db07
feat(api): add csrf protection (#50275)
Co-authored-by: Sboonny <muhammed@freecodecamp.org>
2023-05-18 17:06:40 +05:30
Oliver Eyton-Williams
df12c72f46
test: stop mocking FREECODECAMP_NODE_ENV (#50406)
While this lets us write slightly better tests, I don't think it's worth
the extra complexity. For example, it interferes with the creation of
test databases. We could work around this, but I'd rather keep things
simple.
2023-05-17 22:36:22 +04:00
Oliver Eyton-Williams
c2cb818f87
chore(api): add test utilities (#50289) 2023-05-09 11:15:54 +05:30
Oliver Eyton-Williams
5e17868c74
fix(api): allow fastify to set content-type dynamically (#50248)
fix: allow fastify to set content-type dynamically

We can set content-type: application/json for specific routes, but
doing so ends up with confusing, over-engineered code.

Instead we should take care when auditing the endpoints.
2023-05-02 10:15:31 -07:00
Oliver Eyton-Williams
46cdfd7802
feat(api): add CORS headers (#50120)
* test: allow mocking of env vars

Since utils/env is a module, we can mock it to control env vars in
tests. However, it's not compatible with building the server in
setupFilesAfterEnv, so, instead, we can use a utility function to keep
things DRY.

* fix: update type of fastifyTestInstance

* chore: add comment about sts preload

* chore: rename header plugin

* test: add get util + provide origin on request

* feat: add cors headers

* chore: add TODO
2023-04-26 09:02:12 +02:00
Muhammed Mustafa
01b9bd9245
fix(api): fix eslint error (#50080) 2023-04-17 20:21:36 +05:30
Oliver Eyton-Williams
6289efbbad
test(api): always start server before testing (#49994) 2023-04-17 17:54:50 +07:00
Oliver Eyton-Williams
71d5a67745
feat(api): add security headers (#49995)
* feat(api): add security headers

Includes the OWASP recommended headers for REST APIs. Taken from
https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html#security-headers

* test: check OWASP headers appear on GET / request

* fix: only enable Strict-Transport-Security in prod
2023-04-13 10:16:58 +02:00
Oliver Eyton-Williams
a128dd8fcd
chore(api): compile TS into /dist (#49812
* chore: compile TS into /dist

Having the output co-located with the source meant that the js would be
imported by default. Given that we don't recompile on source changes,
this means the server got 'stuck' at the point of compilation and would
only register changes on build.

Also, compiling to a dist directory should make it easier to build when
we want to deploy. That said, the motivation is mostly DX.

* fix: put schema.prisma in the default location
2023-03-28 19:42:20 +05:30