kra-new/internal/server/middleware/cors_identity_test.go

package middleware

import (
	"strings"
	"testing"
)

func TestDefaultCORSHeadersDoNotAllowUserIdentityHeader(t *testing.T) {
	if strings.Contains(strings.ToLower(defaultCORSHeaders), "x-user-id") {
		t.Fatal("default CORS headers still allow the forgeable x-user-id header")
	}
}