Method TestIsValidExternalHost

internal/api/middleware_test.go:191–321

()

}

func (ts *MiddlewareTestSuite) TestIsValidExternalHost() {
	cases := []struct {
		desc          string
		externalHosts []string

		requestURL string
		headers    http.Header

		expectedURL string
	}{
		{
			desc:        "no defined external hosts, no headers, no absolute request URL",
			requestURL:  "/some-path",
			expectedURL: ts.API.config.API.ExternalURL,
		},

		{
			desc: "no defined external hosts, unauthorized X-Forwarded-Host without any external hosts",
			headers: http.Header{
				"X-Forwarded-Host": []string{
					"external-host.com",
				},
			},
			requestURL:  "/some-path",
			expectedURL: ts.API.config.API.ExternalURL,
		},

		{
			desc:          "defined external hosts, unauthorized X-Forwarded-Host",
			externalHosts: []string{"authorized-host.com"},
			headers: http.Header{
				"X-Forwarded-Proto": []string{"https"},
				"X-Forwarded-Host": []string{
					"external-host.com",
				},
			},
			requestURL:  "/some-path",
			expectedURL: ts.API.config.API.ExternalURL,
		},

		{
			desc:        "no defined external hosts, unauthorized Host",
			requestURL:  "https://external-host.com/some-path",
			expectedURL: ts.API.config.API.ExternalURL,
		},

		{
			desc:          "defined external hosts, unauthorized Host",
			externalHosts: []string{"authorized-host.com"},
			requestURL:    "https://external-host.com/some-path",
			expectedURL:   ts.API.config.API.ExternalURL,
		},

		{
			desc:          "defined external hosts, authorized X-Forwarded-Host",
			externalHosts: []string{"authorized-host.com"},
			headers: http.Header{
				"X-Forwarded-Proto": []string{"http"}, // this should be ignored and default to HTTPS