Function TestFilterUntrusted

coderd/httpmw/realip_test.go:421–474

TestFilterUntrusted tests that untrusted headers are removed from the request.

(t *testing.T)

// TestFilterUntrusted tests that untrusted headers are removed from the request.
func TestFilterUntrusted(t *testing.T) {
	t.Parallel()

	tests := []struct {
		Name               string
		Config             *httpmw.RealIPConfig
		Header             http.Header
		RemoteAddr         string
		ExpectedHeader     http.Header
		ExpectedRemoteAddr string
	}{
		{
			Name: "untrusted-origin",
			Config: &httpmw.RealIPConfig{
				TrustedOrigins: nil,
				TrustedHeaders: []string{
					"Cf-Connecting-Ip",
					"X-Forwarded-For",
					"X-Real-Ip",
					"True-Client-Ip",
				},
			},
			Header: http.Header{
				"X-Forwarded-For":   []string{"1.2.3.4,123.45.67.89"},
				"X-Forwarded-Proto": []string{"https"},
				"X-Real-Ip":         []string{"4.4.4.4"},
				"True-Client-Ip":    []string{"5.6.7.8"},
				"Authorization":     []string{"Bearer 123"},
				"Accept-Encoding":   []string{"gzip", "compress", "deflate", "identity"},
			},
			RemoteAddr: "1.2.3.4",
			ExpectedHeader: http.Header{
				"Authorization":     []string{"Bearer 123"},
				"Accept-Encoding":   []string{"gzip", "compress", "deflate", "identity"},
				"X-Forwarded-Proto": []string{"https"},
			},
			ExpectedRemoteAddr: "1.2.3.4",
		},
	}

	for _, test := range tests {
		t.Run(test.Name, func(t *testing.T) {
			t.Parallel()

			req := httptest.NewRequest(http.MethodGet, "http://localhost", nil)
			req.Header = test.Header
			req.RemoteAddr = test.RemoteAddr

			httpmw.FilterUntrustedOriginHeaders(test.Config, req)
			require.Equal(t, test.ExpectedRemoteAddr, req.RemoteAddr, "remote address should match")
			require.Equal(t, test.ExpectedHeader, req.Header, "filtered headers should match")
		})
	}
}

func TestEffectiveHost(t *testing.T) {
	t.Parallel()