httpclienttest

func CheckRejectsDowngrade ¶

func CheckRejectsDowngrade(t *testing.T, run func(*testing.T, string, http.RoundTripper) error)

CheckRejectsDowngrade drives the caller's real client construction and request path. Only the scheme changes: different httptest listener ports would let a host guard hide a missing TLS guard. No real credentials or network are used.

It runs one parallel subtest per redirect status and starting origin. Each calls run with the start origin and a fake transport; run must build its client with that transport, issue a single credential-bearing request to the origin, and return the resulting error. The transport redirects HTTP to HTTPS and HTTPS to HTTP, so the error must match ErrInsecureRedirect and the plaintext destination after HTTPS must receive no request.