Function TestExtractIPFromXFFHeader

ip_test.go:603–716

(t *testing.T)

}

func TestExtractIPFromXFFHeader(t *testing.T) {
	_, ipForRemoteAddrExternalRange, _ := net.ParseCIDR("203.0.113.199/24")
	_, ipv6ForRemoteAddrExternalRange, _ := net.ParseCIDR("2001:db8::/64")

	var testCases = []struct {
		whenRequest       http.Request
		name              string
		expectIP          string
		givenTrustOptions []TrustOption
	}{
		{
			name: "request has no headers, extracts IP from request remote addr",
			whenRequest: http.Request{
				RemoteAddr: "203.0.113.1:8080",
			},
			expectIP: "203.0.113.1",
		},
		{
			name: "request has INVALID external XFF header, extract IP from remote addr",
			whenRequest: http.Request{
				Header: http.Header{
					HeaderXForwardedFor: []string{"xxx.yyy.zzz.ccc, 127.0.0.2"}, // <-- this is invalid
				},
				RemoteAddr: "127.0.0.1:8080",
			},
			expectIP: "127.0.0.1",
		},
		{
			name: "request trusts all IPs in XFF header, extract IP from furthest in XFF chain",
			whenRequest: http.Request{
				Header: http.Header{
					HeaderXForwardedFor: []string{"127.0.0.3, 127.0.0.2, 127.0.0.1"},
				},
				RemoteAddr: "127.0.0.1:8080",
			},
			expectIP: "127.0.0.3",
		},
		{
			name: "request trusts all IPs in XFF header, extract IP from furthest in XFF chain",
			whenRequest: http.Request{
				Header: http.Header{
					HeaderXForwardedFor: []string{"[fe80::3], [fe80::2], [fe80::1]"},
				},
				RemoteAddr: "[fe80::1]:8080",
			},
			expectIP: "fe80::3",
		},
		{
			name: "request is from external IP has valid + UNTRUSTED external XFF header, extract IP from remote addr",
			whenRequest: http.Request{
				Header: http.Header{
					HeaderXForwardedFor: []string{"203.0.113.199"}, // <-- this is untrusted
				},
				RemoteAddr: "203.0.113.1:8080",
			},
			expectIP: "203.0.113.1",
		},
		{