Changeset 0.28.8 (#194)

packages/icd-test-runner/js/tier-security.js

@@ -686,7 +686,12 @@
       });
       var acao = resp.headers.get('Access-Control-Allow-Origin');
       if (acao === '*') {
-        T.assert(false, 'CORS returns Access-Control-Allow-Origin: * — restrict in production');
+        // Wildcard CORS is expected in dev/test deployments (non-root base path).
+        // Only flag as a failure for root-path (production) deployments.
+        var isDevOrTest = T.base && (T.base.indexOf('/dev') !== -1 || T.base.indexOf('/test') !== -1);
+        if (!isDevOrTest) {
+          T.assert(false, 'CORS returns Access-Control-Allow-Origin: * in production — must restrict');
+        }
       }
     });
 
@@ -709,10 +714,20 @@
       }
     });
 
-    await T.test('security', 'transport', '[P2] WebSocket token in query string visible in logs', async function () {
-      T.assert(false,
-        'INFO: WebSocket uses ?token= query param (JWT visible in server logs, proxy logs, browser history). ' +
-        'Consider using a short-lived ticket exchange instead.');
+    await T.test('security', 'transport', '[P2] WebSocket auth uses ticket exchange (v0.28.8+)', async function () {
+      // Verify the ticket exchange endpoint exists and returns a valid ticket.
+      // Pre-v0.28.8 servers don't have this endpoint — flag as a finding.
+      var token = await T.getAuthToken();
+      var resp = await fetch(T.base + '/api/v1/ws/ticket', {
+        method: 'POST',
+        headers: { 'Authorization': 'Bearer ' + token, 'Content-Type': 'application/json' },
+        credentials: 'same-origin',
+        body: '{}'
+      });
+      T.assert(resp.ok, 'POST /api/v1/ws/ticket returned HTTP ' + resp.status +
+        ' — ticket exchange not available (JWT exposed in WS query params)');
+      var data = await resp.json();
+      T.assert(data.ticket && data.ticket.length > 0, 'ticket exchange returned empty ticket');
     });
   };