test_cors.py•1.02 kB
from __future__ import annotations
import httpx
import pytest
from uniprot_mcp.http_app import app
@pytest.mark.asyncio
async def test_cors_headers_present_on_preflight_and_response():
transport = httpx.ASGITransport(app=app)
async with httpx.AsyncClient(transport=transport, base_url="http://testserver") as client:
preflight = await client.options(
"/mcp",
headers={
"Origin": "https://example.com",
"Access-Control-Request-Method": "POST",
},
)
assert preflight.status_code in (200, 204)
allow_origin = preflight.headers.get("access-control-allow-origin")
assert allow_origin in ("*", "https://example.com")
response = await client.get(
"/healthz",
headers={"Origin": "https://example.com"},
)
assert response.status_code == 200
exposed = response.headers.get("access-control-expose-headers", "")
assert "Mcp-Session-Id" in exposed