Do negative test

connexion/middleware/main.py

@@ -16,12 +16,12 @@ from connexion.lifecycle import ConnexionRequest, ConnexionResponse
 from connexion.middleware.abstract import SpecMiddleware
 from connexion.middleware.context import ContextMiddleware
 from connexion.middleware.exceptions import ExceptionMiddleware
-from connexion.middleware.server_error import ServerErrorMiddleware
 from connexion.middleware.lifespan import Lifespan, LifespanMiddleware
 from connexion.middleware.request_validation import RequestValidationMiddleware
 from connexion.middleware.response_validation import ResponseValidationMiddleware
 from connexion.middleware.routing import RoutingMiddleware
 from connexion.middleware.security import SecurityMiddleware
+from connexion.middleware.server_error import ServerErrorMiddleware
 from connexion.middleware.swagger_ui import SwaggerUIMiddleware
 from connexion.options import SwaggerUIOptions
 from connexion.resolver import Resolver

tests/api/conftest.py

@@ -1,11 +1,11 @@
-from functools import partial
 import logging
+from functools import partial
 
 import pytest
-from starlette.types import Receive, Scope, Send
 from connexion import ConnexionMiddleware
 from connexion.middleware.server_error import ServerErrorMiddleware
 from starlette.middleware.cors import CORSMiddleware
+from starlette.types import Receive, Scope, Send
 
 from conftest import FIXTURES_FOLDER, OPENAPI3_SPEC, build_app_from_fixture
 

tests/api/test_cors.py

@@ -9,9 +9,17 @@ def test_cors_valid(cors_openapi_app):
     assert "Access-Control-Allow-Origin" in response.headers
 
 
+def test_cors_invalid(cors_openapi_app):
+    app_client = cors_openapi_app.test_client()
+    response = app_client.options(
+        "/v1.0/goodday/dan", headers={"Origin": "http://0.0.0.0"}
+    )
+    assert response.status_code == 400
+    assert "Access-Control-Allow-Origin" not in response.headers
+
+
 def test_cors_validation_error(cors_openapi_app):
     app_client = cors_openapi_app.test_client()
-
     response = app_client.post(
         "/v1.0/body-not-allowed-additional-properties",
         data={},