(t *testing.T)
| 25 | ) |
| 26 | |
| 27 | func TestProxyHeaders(t *testing.T) { |
| 28 | a := assertions.New(t) |
| 29 | |
| 30 | var config ProxyConfiguration |
| 31 | err := config.ParseAndAddTrusted("192.0.2.0/24") |
| 32 | a.So(err, should.BeNil) |
| 33 | |
| 34 | m := ProxyHeaders(config) |
| 35 | |
| 36 | t.Run("Trusted X-Forwarded-For", func(t *testing.T) { |
| 37 | a := assertions.New(t) |
| 38 | r := httptest.NewRequest(http.MethodGet, "/path", nil) |
| 39 | r.Header.Set(HeaderXForwardedFor, "12.34.56.78, 10.100.0.1") |
| 40 | r.Header.Set(HeaderXForwardedHost, "thethings.network") |
| 41 | r.Header.Set(HeaderXForwardedProto, SchemeHTTPS) |
| 42 | r.Header.Set(HeaderXRealIP, "12.34.56.78") |
| 43 | r.Header.Set(HeaderXForwardedClientCert, "Subject=\"...\"") |
| 44 | r.RemoteAddr = "192.0.2.1:1234" |
| 45 | rec := httptest.NewRecorder() |
| 46 | m(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { |
| 47 | a.So(r.Header.Get(HeaderXForwardedFor), should.Equal, "12.34.56.78, 10.100.0.1") |
| 48 | a.So(r.Header.Get(HeaderXForwardedHost), should.Equal, "thethings.network") |
| 49 | a.So(r.Header.Get(HeaderXForwardedProto), should.Equal, SchemeHTTPS) |
| 50 | a.So(r.Header.Get(HeaderXRealIP), should.Equal, "12.34.56.78") |
| 51 | a.So(r.Header.Get(HeaderXForwardedClientCert), should.Equal, "Subject=\"...\"") |
| 52 | a.So(r.URL.String(), should.Equal, "https://thethings.network/path") |
| 53 | })).ServeHTTP(rec, r) |
| 54 | }) |
| 55 | |
| 56 | t.Run("Trusted Forwarded", func(t *testing.T) { |
| 57 | a := assertions.New(t) |
| 58 | r := httptest.NewRequest(http.MethodGet, "/path", nil) |
| 59 | r.Header.Set(HeaderForwarded, "for=12.34.56.78, for=10.100.0.1;host=thethings.network;proto=https") |
| 60 | r.Header.Set(HeaderXRealIP, "12.34.56.78") |
| 61 | r.Header.Set(HeaderXForwardedTLSClientCert, "MIIDEDCC...") |
| 62 | r.Header.Set(HeaderXForwardedTLSClientCertInfo, "Subject=\"...\"") |
| 63 | r.RemoteAddr = "192.0.2.1:1234" |
| 64 | rec := httptest.NewRecorder() |
| 65 | m(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { |
| 66 | a.So(r.Header.Get(HeaderForwarded), should.Equal, "for=12.34.56.78, for=10.100.0.1;host=thethings.network;proto=https") |
| 67 | a.So(r.Header.Get(HeaderXRealIP), should.Equal, "12.34.56.78") |
| 68 | a.So(r.Header.Get(HeaderXForwardedTLSClientCert), should.Equal, "MIIDEDCC...") |
| 69 | a.So(r.Header.Get(HeaderXForwardedTLSClientCertInfo), should.Equal, "Subject=\"...\"") |
| 70 | a.So(r.URL.String(), should.Equal, "https://thethings.network/path") |
| 71 | })).ServeHTTP(rec, r) |
| 72 | }) |
| 73 | |
| 74 | t.Run("Untrusted X-Forwarded-For", func(t *testing.T) { |
| 75 | a := assertions.New(t) |
| 76 | r := httptest.NewRequest(http.MethodGet, "/path", nil) |
| 77 | r.Header.Set(HeaderXForwardedFor, "12.34.56.78") |
| 78 | r.Header.Set(HeaderXForwardedHost, "thethings.network") |
| 79 | r.Header.Set(HeaderXForwardedProto, SchemeHTTPS) |
| 80 | r.Header.Set(HeaderXRealIP, "12.34.56.78") |
| 81 | r.RemoteAddr = "12.34.56.1:1234" |
| 82 | rec := httptest.NewRecorder() |
| 83 | m(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { |
| 84 | for _, header := range []string{HeaderForwarded, HeaderXForwardedFor, HeaderXForwardedHost, HeaderXForwardedProto} { |
nothing calls this directly
no test coverage detected