PapaTramp
80320ae698
Close audit findings: anti-spoof client IP for login rate limit, JWT/CORS enforce on startup, SSH host-key verification and sudo via stdin, optional WinRM HTTPS, SSE httpOnly cookie auth, ingest body limit, ILIKE escaping, and HMAC API key hashing with legacy SHA-256 fallback.
27 lines
902 B
Python
27 lines
902 B
Python
"""Tests for client IP resolution behind reverse proxy."""
|
|
|
|
from types import SimpleNamespace
|
|
|
|
from app.services.client_ip import client_ip_from_request
|
|
|
|
|
|
def _request(*, client_host: str = "10.0.0.5", xff: str | None = None):
|
|
headers = {}
|
|
if xff is not None:
|
|
headers["x-forwarded-for"] = xff
|
|
return SimpleNamespace(client=SimpleNamespace(host=client_host), headers=headers)
|
|
|
|
|
|
def test_client_ip_without_forwarded_header():
|
|
assert client_ip_from_request(_request(client_host="203.0.113.10")) == "203.0.113.10"
|
|
|
|
|
|
def test_client_ip_uses_last_forwarded_hop():
|
|
req = _request(client_host="127.0.0.1", xff="203.0.113.99, 198.51.100.20")
|
|
assert client_ip_from_request(req) == "198.51.100.20"
|
|
|
|
|
|
def test_client_ip_ignores_spoofed_first_hop():
|
|
req = _request(client_host="127.0.0.1", xff="1.2.3.4, 203.0.113.50")
|
|
assert client_ip_from_request(req) == "203.0.113.50"
|