Function TestExtractIPFromRealIPHeader

ip_test.go:492–601

(t *testing.T)

}

func TestExtractIPFromRealIPHeader(t *testing.T) {
	_, ipForRemoteAddrExternalRange, _ := net.ParseCIDR("203.0.113.199/24")
	_, ipv6ForRemoteAddrExternalRange, _ := net.ParseCIDR("2001:db8::/64")

	var testCases = []struct {
		whenRequest       http.Request
		name              string
		expectIP          string
		givenTrustOptions []TrustOption
	}{
		{
			name: "request has no headers, extracts IP from request remote addr",
			whenRequest: http.Request{
				RemoteAddr: "203.0.113.1:8080",
			},
			expectIP: "203.0.113.1",
		},
		{
			name: "request is from external IP has INVALID external X-Real-Ip header, extract IP from remote addr",
			whenRequest: http.Request{
				Header: http.Header{
					HeaderXRealIP: []string{"xxx.yyy.zzz.ccc"}, // <-- this is invalid
				},
				RemoteAddr: "203.0.113.1:8080",
			},
			expectIP: "203.0.113.1",
		},
		{
			name: "request is from external IP has valid + UNTRUSTED external X-Real-Ip header, extract IP from remote addr",
			whenRequest: http.Request{
				Header: http.Header{
					HeaderXRealIP: []string{"203.0.113.199"}, // <-- this is untrusted
				},
				RemoteAddr: "203.0.113.1:8080",
			},
			expectIP: "203.0.113.1",
		},
		{
			name: "request is from external IP has valid + UNTRUSTED external X-Real-Ip header, extract IP from remote addr",
			whenRequest: http.Request{
				Header: http.Header{
					HeaderXRealIP: []string{"[2001:db8::113:199]"}, // <-- this is untrusted
				},
				RemoteAddr: "[2001:db8::113:1]:8080",
			},
			expectIP: "2001:db8::113:1",
		},
		{
			name: "request is from external IP has valid + TRUSTED X-Real-Ip header, extract IP from X-Real-Ip header",
			givenTrustOptions: []TrustOption{ // case for "trust direct-facing proxy"
				TrustIPRange(ipForRemoteAddrExternalRange), // we trust external IP range "203.0.113.199/24"
			},
			whenRequest: http.Request{
				Header: http.Header{
					HeaderXRealIP: []string{"203.0.113.199"},
				},
				RemoteAddr: "203.0.113.1:8080",
			},