spec/support/shared_examples/controllers/base_action_controller_shared_examples.rb


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

# frozen_string_literal: true

# Requires `request` subject to be defined
#
# subject(:request) { get root_path }
RSpec.shared_examples 'Base action controller' do
  describe 'security headers' do
    describe 'Cross-Origin-Opener-Policy' do
      it 'sets the header' do
        request

        expect(response.headers['Cross-Origin-Opener-Policy']).to eq('same-origin')
      end

      context 'when coop_header feature flag is disabled' do
        it 'does not set the header' do
          stub_feature_flags(coop_header: false)

          request

          expect(response.headers['Cross-Origin-Opener-Policy']).to be_nil
        end
      end
    end
  end
end