Skip to content

Comments

test(proxy): add comprehensive tests for BFF API proxy handler#315

Merged
fpindej merged 1 commit intomasterfrom
test/api-proxy-298
Feb 24, 2026
Merged

test(proxy): add comprehensive tests for BFF API proxy handler#315
fpindej merged 1 commit intomasterfrom
test/api-proxy-298

Conversation

@fpindej
Copy link
Owner

@fpindej fpindej commented Feb 24, 2026

Summary

  • Adds 36 tests for the BFF API proxy catch-all route (/api/[...path]/+server.ts)
  • Covers CSRF origin validation (same-origin, cross-origin, allowed origins, missing origin, port mismatch, case sensitivity)
  • Tests request header allowlist filtering (forwarded vs stripped headers, x-forwarded-for/proto)
  • Tests response header stripping (removes server/connection/transfer-encoding/x-powered-by, preserves content-type and status)
  • Tests URL construction (backend URL, query parameter forwarding, useCookies for auth paths)
  • Tests error handling (ECONNREFUSED -> 503, unexpected errors -> 502, console logging)

Closes #298

Test plan

  • All 36 new proxy tests pass
  • All 86 total tests pass (no regressions)
  • pnpm run format — clean
  • pnpm run lint — clean
  • pnpm run check — 0 errors (only pre-existing warnings in unrelated files)

🤖 Generated with Claude Code

@fpindej fpindej added security Security-related issues frontend Frontend (SvelteKit) labels Feb 24, 2026
@fpindej fpindej enabled auto-merge (squash) February 24, 2026 05:11
Covers CSRF origin validation, request header allowlist filtering,
response header stripping, URL construction with cookie auth paths,
and error handling for backend connection failures. Closes #298

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@fpindej fpindej merged commit ad0ae1f into master Feb 24, 2026
4 checks passed
@fpindej fpindej deleted the test/api-proxy-298 branch February 24, 2026 05:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

frontend Frontend (SvelteKit) security Security-related issues

Projects

None yet

Development

Successfully merging this pull request may close these issues.

test(frontend): add tests for API proxy security boundary

1 participant