Integrations-Test-Assertions für CSRF-Token-Extraktion und SameSite-Cookie-Header

export function verifySecurityHeaders(responseHeaders) {
  const cookieHeader = responseHeaders.get('set-cookie') || '';
  const csrfHeader = responseHeaders.get('x-csrf-token') || '';
 
  const hasStrictSameSite = /SameSite=Strict/i.test(cookieHeader);
  const hasSecureFlag = /Secure/i.test(cookieHeader);
  const isValidCsrfToken = csrfHeader.length >= 32;
 
  return {
    isSecure: hasStrictSameSite && hasSecureFlag && isValidCsrfToken,
    audit: {
      strictSameSite: hasStrictSameSite,
      secureCookie: hasSecureFlag,
      validCsrfLength: isValidCsrfToken
    }
  };
}