Testing Strategy Best Practices

Testing Strategy Best Practices

class SecurityHeadersTestStrategy {
    constructor() {
        this.testSuites = {
            unit: this.createUnitTests(),
            integration: this.createIntegrationTests(),
            e2e: this.createE2ETests()
        };
    }
    
    createUnitTests() {
        return {
            name: 'Unit Tests',
            tests: [
                {
                    name: 'CSP nonce generation',
                    test: () => {
                        const nonce1 = generateNonce();
                        const nonce2 = generateNonce();
                        assert(nonce1 !== nonce2, 'Nonces should be unique');
                        assert(nonce1.length >= 16, 'Nonce should be at least 16 characters');
                    }
                },
                {
                    name: 'Header value validation',
                    test: () => {
                        const validCSP = "default-src 'self'";
                        const invalidCSP = "default-src self"; // Missing quotes
                        assert(validateCSP(validCSP), 'Valid CSP should pass');
                        assert(!validateCSP(invalidCSP), 'Invalid CSP should fail');
                    }
                }
            ]
        };
    }
    
    createIntegrationTests() {
        return {
            name: 'Integration Tests',
            tests: [
                {
                    name: 'Headers applied to all routes',
                    test: async () => {
                        const routes = ['/api/users', '/login', '/static/css/style.css'];
                        
                        for (const route of routes) {
                            const response = await request(app).get(route);
                            assert(response.headers['x-content-type-options'] === 'nosniff');
                            assert(response.headers['x-frame-options']);
                        }
                    }
                },
                {
                    name: 'CSP report endpoint',
                    test: async () => {
                        const report = {
                            'csp-report': {
                                'blocked-uri': 'https://evil.com/script.js',
                                'document-uri': 'https://example.com',
                                'violated-directive': 'script-src'
                            }
                        };
                        
                        const response = await request(app)
                            .post('/csp-report')
                            .send(report)
                            .set('Content-Type', 'application/csp-report');
                        
                        assert(response.status === 204);
                    }
                }
            ]
        };
    }
    
    createE2ETests() {
        return {
            name: 'End-to-End Tests',
            tests: [
                {
                    name: 'Page loads with security headers',
                    test: async () => {
                        const browser = await puppeteer.launch();
                        const page = await browser.newPage();
                        
                        const responses = [];
                        page.on('response', response => {
                            responses.push({
                                url: response.url(),
                                headers: response.headers()
                            });
                        });
                        
                        await page.goto('https://localhost:3000');
                        
                        const mainResponse = responses.find(r => r.url === 'https://localhost:3000/');
                        assert(mainResponse.headers['content-security-policy']);
                        assert(mainResponse.headers['x-frame-options']);
                        
                        await browser.close();
                    }
                }
            ]
        };
    }
}