I am writing a simple test to ensure that the "X-Frame-Options" value is set to Deny for my webpage, I use Selenium Webdriver within cucumber but have read that Selenium does not support the retrieval/setting of these headers. I have found small snippets where poltergeist can access these values and have got close when trying things in the console
What I have used so far is
@headers = page.driver.network_traffic[1].response_parts.uniq
Which in my case returns
#<Capybara::Poltergeist::NetworkTraffic::Response:0x00000003a530b8
@data=
{"bodySize"=>4752,
"contentType"=>"text/html",
"headers"=>
[{"name"=>"Date", "value"=>"Thu, 23 Jul 2015 06:23:49 GMT"},
{"name"=>"Server", "value"=>"Apache/2.2.22 (Ubuntu)"},
{"name"=>"X-Powered-By", "value"=>"PHP/5.3.10-1ubuntu3.18"},
{"name"=>"Set-Cookie", "value"=> "PHPSESSID=sessionidhere; path=/; domain=mydomain; secure; HttpOnly"},
{"name"=>"Expires", "value"=>"Thu, 19 Nov 1981 08:52:00 GMT"},
{"name"=>"Cache-Control", "value"=> "no-store, no-cache, must-revalidate, post-check=0, pre-check=0"},
{"name"=>"Pragma", "value"=>"no-cache"},
{"name"=>"X-Frame-Options", "value"=>"DENY"},
{"name"=>"Vary", "value"=>"Accept-Encoding"},
{"name"=>"Content-Encoding", "value"=>"gzip"},
{"name"=>"Keep-Alive", "value"=>"timeout=5, max=100"},
{"name"=>"Connection", "value"=>"Keep-Alive"},
{"name"=>"Content-Type", "value"=>"text/html"}],
"id"=>2,
"redirectURL"=>nil,
"stage"=>"start",
"status"=>200,
"statusText"=>"OK",
"time"=>"2015-07-23T06:29:19.233Z",
"url"=>"http://mysite-address.co.uk"}>
Is there a way I can just pull out the X Frame Options and assign it to my instance variable? I'm having trouble navigating through the array and key/values.
Or is there a better way of doing this?
I have got a little further with this
So I have
@headers = page.driver.network_traffic[1].response_parts.uniq
@headers[0].headers.find { |h| h['name'] == 'X-Frame-Options' }
# {"name"=>"X-Frame-Options", "value"=>"DENY"}
If I then try
@headers[0].headers.find { |h| h['name'] == 'X-Frame-Options' }['value']
# "DENY"
So I think this is now done, unless anyone can spot something I haven't or have an easier way?
If you have rspec-expectations, could you use:
expect(response_headers['X-Frame-Options']).to include('Deny')
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With