Repository: withastro/astro
File: packages/astro/test/csrf-protection.test.js (JavaScript)

Code before:
		assert.deepEqual(await response.json(), {
			something: 'true',
		});

		request = new Request('http://example.com/api/', {
			headers: { origin: 'http://loreum.com', 'content-type': 'application/x-www-form-urlencoded' },
			method: 'GET',
		});
		response = await app.render(request);
		assert.equal(response.status, 200);
		assert.deepEqual(await response.json(), {
			something: 'true',
		});

		request = new Request('http://example.com/api/', {
			headers: { origin: 'http://loreum.com', 'content-type': 'text/plain' },
			method: 'GET',
		});
		response = await app.render(request);
		assert.equal(response.status, 200);
		assert.deepEqual(await response.json(), {
			something: 'true',
		});
	});

	it("return a 200 when the origin doesn't match but calling HEAD", async () => {
		let request;
		let response;
		request = new Request('http://example.com/api/', {
			headers: { origin: 'http://loreum.com', 'content-type': 'multipart/form-data' },
			method: 'HEAD',
		});
		response = await app.render(request);
		assert.equal(response.status, 200);
		assert.deepEqual(await response.json(), {});

		request = new Request('http://example.com/api/', {
			headers: { origin: 'http://loreum.com', 'content-type': 'application/x-www-form-urlencoded' },
			method: 'HEAD',
		});
		response = await app.render(request);
		assert.equal(response.status, 200);
		assert.deepEqual(await response.json(), {});

		request = new Request('http://example.com/api/', {
			headers: { origin: 'http://loreum.com', 'content-type': 'text/plain' },
			method: 'HEAD',
		});
		response = await app.render(request);
		assert.equal(response.status, 200);
		assert.deepEqual(await response.json(), {});

Review comment (security):
Since this is quite a delicate feature that involves security, would you mind adding a test for each verb method that was added to `SAFE_METHODS`? I would like to cover all cases if possible 

Code after:
		assert.deepEqual(await response.json(), {
			something: 'true',
		});

		request = new Request('http://example.com/api/', {
			headers: { origin: 'http://loreum.com', 'content-type': 'application/x-www-form-urlencoded' },
			method: 'GET',
		});
		response = await app.render(request);
		assert.equal(response.status, 200);
		assert.deepEqual(await response.json(), {
			something: 'true',
		});

		request = new Request('http://example.com/api/', {
			headers: { origin: 'http://loreum.com', 'content-type': 'text/plain' },
			method: 'GET',
		});
		response = await app.render(request);
		assert.equal(response.status, 200);
		assert.deepEqual(await response.json(), {
			something: 'true',
		});
	});

	it("return a 200 when the origin doesn't match but calling HEAD", async () => {
		let request;
		let response;
		request = new Request('http://example.com/api/', {
			headers: { origin: 'http://loreum.com', 'content-type': 'multipart/form-data' },
			method: 'HEAD',
		});
		response = await app.render(request);
		assert.equal(response.status, 200);

		request = new Request('http://example.com/api/', {
			headers: { origin: 'http://loreum.com', 'content-type': 'application/x-www-form-urlencoded' },
			method: 'HEAD',
		});
		response = await app.render(request);
		assert.equal(response.status, 200);

		request = new Request('http://example.com/api/', {
			headers: { origin: 'http://loreum.com', 'content-type': 'text/plain' },
			method: 'HEAD',
		});
		response = await app.render(request);
		assert.equal(response.status, 200);
	});

	it("return a 200 when the origin doesn't match but calling OPTIONS", async () => {