bandit

0.5.8

1.12.4 1.12.3 1.12.2 1.12.1 1.12.0 1.11.1 1.11.0 1.10.4 1.10.3 1.10.2 1.10.1 1.10.0 retired 1.9.0 1.8.0 1.7.0 1.6.11 1.6.10 1.6.9 1.6.8 1.6.7 1.6.6 1.6.5 1.6.4 1.6.3 1.6.2 1.6.1 1.6.0 1.5.7 1.5.6 1.5.5 1.5.4 1.5.3 1.5.2 1.5.1 1.5.0 1.4.2 1.4.1 1.4.0 1.3.0 1.2.3 1.2.2 1.2.1 1.2.0 1.1.3 1.1.2 1.1.1 1.1.0 1.0.0 1.0.0-pre.18 1.0.0-pre.17 1.0.0-pre.16 1.0.0-pre.15 1.0.0-pre.14 1.0.0-pre.13 1.0.0-pre.12 1.0.0-pre.11 1.0.0-pre.10 1.0.0-pre.9 1.0.0-pre.8 1.0.0-pre.7 1.0.0-pre.6 1.0.0-pre.5 1.0.0-pre.4 1.0.0-pre.3 1.0.0-pre.2 1.0.0-pre.1 0.7.7 0.7.6 0.7.5 0.7.4 0.7.3 0.7.2 0.7.1 0.7.0 0.6.11 0.6.10 0.6.9 0.6.8 0.6.7 0.6.6 0.6.5 0.6.4 0.6.3 0.6.2 0.6.1 0.6.0 0.5.11 0.5.10 0.5.9 0.5.8 0.5.7 0.5.6 0.5.5 0.5.4 0.5.3 0.5.2 0.5.1 0.5.0 0.4.10 0.4.9 0.4.8 0.4.7 0.4.6 0.4.5 0.4.4 0.4.3 0.4.2 0.4.1 0.4.0 0.3.9 0.3.8 0.3.7 0.3.6 0.3.5 0.3.4 0.3.3 0.3.2 0.2.3 0.2.2 0.2.1 0.2.0 0.1.1 0.1.0

A pure-Elixir HTTP server built for Plug & WebSock apps

Security advisory: This version has known vulnerabilities. View advisories

HexDocs

Current section

Files

Jump to

Readme 123 Versions 4 Dependencies Dependants 8 Advisories Files Activity

bandit test bandit websocket http1_handshake_test.exs

Raw

test/bandit/websocket/http1_handshake_test.exs

defmodule WebSocketHTTP1HandshakeTest do
  # This is fundamentally a test of the Plug helpers in Bandit.WebSocket.Handshake, so we define
  # a simple Plug that uses these handshakes to upgrade to a no-op Sock implementation

  use ExUnit.Case, async: true
  use ServerHelpers

  import TestHelpers

  # credo:disable-for-this-file Credo.Check.Design.AliasUsage

  setup :http_server

  defmodule MyNoopSock do
    use NoopSock
  end

  def call(conn, _opts) do
    conn
    |> Bandit.WebSocket.Handshake.handshake?()
    |> case do
      true ->
        conn
        |> Plug.Conn.upgrade_adapter(:websocket, {MyNoopSock, []})

      false ->
        conn
        |> Plug.Conn.send_resp(204, <<>>)
    end
  end

  describe "HTTP/1.1 handshake" do
    test "accepts well formed requests", context do
      client = SimpleWebSocketClient.tcp_client(context)

      :gen_tcp.send(client, """
      GET /websocket_test HTTP/1.1\r
      Host: server.example.com\r
      Upgrade: WeBsOcKeT\r
      Connection: UpGrAdE\r
      Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\r
      Sec-WebSocket-Version: 13\r
      \r
      """)

      {:ok, response} = :gen_tcp.recv(client, 0)

      assert [
               "HTTP/1.1 101 Switching Protocols",
               "date: " <> date,
               "cache-control: max-age=0, private, must-revalidate",
               "upgrade: websocket",
               "connection: Upgrade",
               "sec-websocket-accept: s3pPLMBiTxaQ9kYGzzhZRbK+xOo=",
               "",
               ""
             ] = String.split(response, "\r\n")

      assert valid_date_header?(date)
    end

    test "does not accept non-GET requests", context do
      client = SimpleWebSocketClient.tcp_client(context)

      :gen_tcp.send(client, """
      POST /websocket_test HTTP/1.1\r
      Host: server.example.com\r
      Upgrade: websocket\r
      Connection: Upgrade\r
      Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\r
      Sec-WebSocket-Version: 13\r
      \r
      """)

      {:ok, response} = :gen_tcp.recv(client, 0)

      # Assert that we receive an HTTP response from Plug (ie: we do not upgrade)
      assert [
               "HTTP/1.1 204 No Content",
               "date: " <> date,
               "cache-control: max-age=0, private, must-revalidate",
               "",
               ""
             ] = String.split(response, "\r\n")

      assert valid_date_header?(date)
    end

    test "does not accept non-HTTP/1.1 requests", context do
      client = SimpleWebSocketClient.tcp_client(context)

      :gen_tcp.send(client, """
      GET /websocket_test HTTP/1.0\r
      Host: server.example.com\r
      Upgrade: websocket\r
      Connection: Upgrade\r
      Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\r
      Sec-WebSocket-Version: 13\r
      \r
      """)

      {:ok, response} = :gen_tcp.recv(client, 0)

      # Assert that we receive an HTTP response from Plug (ie: we do not upgrade)
      assert [
               "HTTP/1.0 204 No Content",
               "date: " <> date,
               "cache-control: max-age=0, private, must-revalidate",
               "",
               ""
             ] = String.split(response, "\r\n")

      assert valid_date_header?(date)
    end

    test "does not accept requests without a host header", context do
      client = SimpleWebSocketClient.tcp_client(context)

      :gen_tcp.send(client, """
      GET /websocket_test HTTP/1.1\r
      Upgrade: websocket\r
      Connection: Upgrade\r
      Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\r
      Sec-WebSocket-Version: 13\r
      \r
      """)

      {:ok, response} = :gen_tcp.recv(client, 0)

      assert [
               "HTTP/1.1 204 No Content",
               "date: " <> date,
               "cache-control: max-age=0, private, must-revalidate",
               "",
               ""
             ] = String.split(response, "\r\n")

      assert valid_date_header?(date)
    end

    test "does not accept non-websocket upgrade requests", context do
      client = SimpleWebSocketClient.tcp_client(context)

      :gen_tcp.send(client, """
      GET /websocket_test HTTP/1.1\r
      Host: server.example.com\r
      Upgrade: bogus\r
      Connection: Upgrade\r
      Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\r
      Sec-WebSocket-Version: 13\r
      \r
      """)

      {:ok, response} = :gen_tcp.recv(client, 0)

      assert [
               "HTTP/1.1 204 No Content",
               "date: " <> date,
               "cache-control: max-age=0, private, must-revalidate",
               "",
               ""
             ] = String.split(response, "\r\n")

      assert valid_date_header?(date)
    end

    test "does not accept non-upgrade requests", context do
      client = SimpleWebSocketClient.tcp_client(context)

      :gen_tcp.send(client, """
      GET /websocket_test HTTP/1.1\r
      Host: server.example.com\r
      Upgrade: websocket\r
      Connection: close\r
      Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\r
      Sec-WebSocket-Version: 13\r
      \r
      """)

      {:ok, response} = :gen_tcp.recv(client, 0)

      assert [
               "HTTP/1.1 204 No Content",
               "date: " <> date,
               "cache-control: max-age=0, private, must-revalidate",
               "",
               ""
             ] = String.split(response, "\r\n")

      assert valid_date_header?(date)
    end

    test "does not accept requests without a request key", context do
      client = SimpleWebSocketClient.tcp_client(context)

      :gen_tcp.send(client, """
      GET /websocket_test HTTP/1.1\r
      Host: server.example.com\r
      Upgrade: bogus\r
      Connection: Upgrade\r
      Sec-WebSocket-Version: 13\r
      \r
      """)

      {:ok, response} = :gen_tcp.recv(client, 0)

      assert [
               "HTTP/1.1 204 No Content",
               "date: " <> date,
               "cache-control: max-age=0, private, must-revalidate",
               "",
               ""
             ] = String.split(response, "\r\n")

      assert valid_date_header?(date)
    end

    test "does not accept requests without a version of 13", context do
      client = SimpleWebSocketClient.tcp_client(context)

      :gen_tcp.send(client, """
      GET /websocket_test HTTP/1.1\r
      Host: server.example.com\r
      Upgrade: websocket\r
      Connection: Upgrade\r
      Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\r
      Sec-WebSocket-Version: 12\r
      \r
      """)

      {:ok, response} = :gen_tcp.recv(client, 0)

      assert [
               "HTTP/1.1 204 No Content",
               "date: " <> date,
               "cache-control: max-age=0, private, must-revalidate",
               "",
               ""
             ] = String.split(response, "\r\n")

      assert valid_date_header?(date)
    end
  end
end

Operator	Description	Example
name:	Match package name. Supports * wildcards and repo/package form	name:phx* or name:hexpm/phoenix
description:	Full-text search of package descriptions	description:auth
depends:	Packages depending on a given package. Supports repo:package form	depends:ecto or depends:hexpm:ecto
build_tool:	Filter by build tool	build_tool:mix
updated_after:	Packages updated after an ISO8601 datetime	updated_after:2025-01-01T00:00:00Z
extra:	Match custom metadata (key,value). Nested keys are separated by commas	extra:license,MIT