skill-actions-security-fixture

Test action request security enforcement by validating that cross-origin requests are blocked and disallowed HTTP methods are rejected using a security fixture. It provides deterministic request templates to verify same-origin and method allowlist policies.

A security fixture for plugin testing is a tool that enforces security constraints on configured action requests by blocking disallowed origins, methods, and oversized payloads. It verifies policy enforcement before deploying new action handlers.

Verify request body size limits by configuring a maxBodyBytes rule in your security fixture, which rejects oversized request payloads. This ensures your action handlers correctly enforce bounded payload handling.

Yes, you can use this fixture in automated plugin security guard tests to validate per-action security policies. It satisfies sameOriginOnly, allowMethods, and maxBodyBytes requirements, providing deterministic templates for verification.

Yes, the action validation fixture supports cross-origin blocking by ensuring requests marked for same-origin enforcement cannot target external domains. This verifies that your same-origin access constraints are properly applied.

Testing action security constraints with this basic fixture is limited to deterministic validation of same-origin, method allowlisting, and payload size rules. It does not support complex dynamic threat simulation or authentication testing.