Function TestTrustedOrigins

coderd/httpmw/realip_test.go:226–303

TestTrustedOrigins tests different settings for TrustedOrigins.

(t *testing.T)

// TestTrustedOrigins tests different settings for TrustedOrigins.
func TestTrustedOrigins(t *testing.T) {
	t.Parallel()

	// Remote client protocol: HTTP or HTTPS
	for _, proto := range []string{"http", "https"} {
		// Trusted origin
		// all: default behavior, trust all origins
		// none: use an empty set (nothing will be accepted in this case)
		// ipv4: trust an IPv6 network
		// ipv6: trust an IPv4 network
		for _, trusted := range []string{"none", "ipv4", "ipv6"} {
			for _, header := range []string{"Cf-Connecting-Ip", "True-Client-Ip", "X-Real-Ip", "X-Forwarded-For"} {
				name := fmt.Sprintf("%s-%s-%s", trusted, proto, strings.ToLower(header))

				t.Run(name, func(t *testing.T) {
					t.Parallel()

					remoteAddr := "10.10.10.10"
					actualAddr := "12.34.56.78"

					config := &httpmw.RealIPConfig{
						TrustedHeaders: []string{
							"Cf-Connecting-Ip",
							"X-Forwarded-For",
							"X-Real-Ip",
							"True-Client-Ip",
						},
					}
					switch trusted {
					case "none":
						config.TrustedOrigins = []*net.IPNet{}
					case "ipv4":
						config.TrustedOrigins = []*net.IPNet{
							{
								IP:   net.ParseIP("10.0.0.0"),
								Mask: net.CIDRMask(24, 32),
							},
						}
						remoteAddr = "10.0.0.1"
					case "ipv6":
						config.TrustedOrigins = []*net.IPNet{
							{
								IP:   net.ParseIP("2606:4700::0"),
								Mask: net.CIDRMask(32, 128),
							},
						}
						remoteAddr = "2606:4700:4700::1111"
					}

					middleware := httpmw.ExtractRealIP(config)
					req := httptest.NewRequest(http.MethodGet, "http://localhost", nil)
					req.Header.Set(header, actualAddr)
					req.RemoteAddr = remoteAddr
					if proto == "https" {
						req.TLS = &tls.ConnectionState{}
					}

					handlerCalled := false