stellarkit-api/manual-verification.sh at main · KunmiWrites-bit/stellarkit-api · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
#!/bin/bash

# Manual Verification Script for X-Powered-By Header Fix
# This script demonstrates how to manually verify the security fix

echo "╔══════════════════════════════════════════════════════════════╗"
echo "║  X-Powered-By Header Removal - Manual Verification Guide    ║"
echo "╚══════════════════════════════════════════════════════════════╝"
echo ""

echo "STEP 1: Start the server in one terminal"
echo "───────────────────────────────────────"
echo "Run:  npm run dev"
echo "Wait for: '🚀 StellarKit API running on port 3000'"
echo ""

echo "STEP 2: Test the /health endpoint (in another terminal)"
echo "────────────────────────────────────────────────────────"
echo "Command:"
echo "  curl -i http://localhost:3000/health"
echo ""
echo "Expected response headers:"
echo "  ✓ HTTP/1.1 200 OK"
echo "  ✓ Content-Type: application/json"
echo "  ✓ X-Request-ID: (auto-generated)"
echo "  ✗ NO 'X-Powered-By' header should appear"
echo ""
echo "If you see 'X-Powered-By: Express' in the response, the fix is not applied."
echo ""

echo "STEP 3: Test other endpoints to verify consistency"
echo "────────────────────────────────────────────────────"
echo "Root endpoint:"
echo "  curl -i http://localhost:3000/"
echo ""
echo "Validation error (should still be absent on 400 response):"
echo "  curl -i http://localhost:3000/account/INVALID_KEY"
echo ""
echo "Not found error (should be absent on 404 response):"
echo "  curl -i http://localhost:3000/unknown-route"
echo ""

echo "STEP 4: Verify no X-Powered-By in all responses"
echo "────────────────────────────────────────────────"
echo "All of the above should NOT contain X-Powered-By header."
echo ""

echo "STEP 5: Check the implementation"
echo "─────────────────────────────────"
echo "View the fix in src/index.js:"
echo "  grep -A 1 'disable.*x-powered-by' src/index.js"
echo ""
echo "Expected output:"
echo "  app.disable('x-powered-by');"
echo "  // Disable server identification header for security"
echo ""

echo "STEP 6: Run the test suite (after npm install)"
echo "───────────────────────────────────────────────"
echo "Command:"
echo "  npm test -- tests/security.xPoweredBy.test.js"
echo ""
echo "Expected: All 7 tests pass"
echo "  ✓ should not include X-Powered-By header on /health"
echo "  ✓ should return successful response with correct data"
echo "  ✓ should not include X-Powered-By header on root endpoint"
echo "  ✓ should not include X-Powered-By header even on validation errors"
echo "  ✓ should not include X-Powered-By header on network-status endpoint"
echo "  ✓ should not include X-Powered-By header on fee-estimate endpoint"
echo "  ✓ should not include X-Powered-By header on POST requests"
echo "  ✓ should not include X-Powered-By header on 404 responses"
echo ""

echo "TROUBLESHOOTING"
echo "═══════════════"
echo ""
echo "If X-Powered-By header is still present:"
echo "  1. Verify src/index.js line 37-39 contains:"
echo "     app.disable('x-powered-by');"
echo "  2. Restart the server (npm run dev)"
echo "  3. Clear any proxy/cache between you and the server"
echo ""

echo "If tests fail to run:"
echo "  1. Ensure dependencies are installed: npm install"
echo "  2. The project uses Jest and Supertest"
echo "  3. Check package.json has test script"
echo ""

echo "╔══════════════════════════════════════════════════════════════╗"
echo "║                     End of Verification Guide               ║"
echo "╚══════════════════════════════════════════════════════════════╝"