v0.2.10

src/routes/tests.rs

@@ -524,6 +524,40 @@ async fn security_headers_are_opt_in_and_content_type_aware() {
     assert!(api.headers().get("cross-origin-opener-policy").is_none());
 }
 
+#[tokio::test]
+async fn pdf_api_responses_allow_same_origin_preview_frames() {
+    let app = Router::new()
+        .route(
+            "/api/test.pdf",
+            get(|| async {
+                Response::builder()
+                    .header("content-type", "application/pdf")
+                    .body(Body::from("%PDF-1.4\n"))
+                    .unwrap()
+            }),
+        )
+        .layer(middleware::from_fn(add_security_headers));
+
+    let response = app
+        .oneshot(
+            Request::builder()
+                .uri("/api/test.pdf")
+                .body(Body::empty())
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(response.headers()["x-frame-options"], "SAMEORIGIN");
+    assert_eq!(
+        response.headers()["content-security-policy"],
+        "frame-ancestors 'self'"
+    );
+    assert_eq!(
+        response.headers()["cross-origin-resource-policy"],
+        "same-origin"
+    );
+}
+
 #[tokio::test]
 async fn root_serves_embedded_rustbox_ui() {
     let dir = setup_static_dir();