30 lines
1.4 KiB
TypeScript
30 lines
1.4 KiB
TypeScript
import { describe, expect, it } from "vitest";
|
|
|
|
import { getTrustedClientIp } from "./IpUtils";
|
|
|
|
const req = (headers: Record<string, string>) => new Request("https://app.example.test/", { headers });
|
|
|
|
describe("getTrustedClientIp", () => {
|
|
it("accepts Cloudflare's client header only behind a Cloudflare peer", () => {
|
|
expect(
|
|
getTrustedClientIp(req({ "x-forwarded-for": "1.2.3.4, 173.245.48.10", "cf-connecting-ip": "203.0.113.5" })),
|
|
).toBe("203.0.113.5");
|
|
});
|
|
|
|
it("uses only the rightmost Traefik-appended XFF hop and ignores X-Client-IP", () => {
|
|
expect(getTrustedClientIp(req({ "x-forwarded-for": "1.2.3.4, 203.0.113.9" }))).toBe("203.0.113.9");
|
|
expect(getTrustedClientIp(req({ "x-client-ip": "203.0.113.9" }))).toBe("unknown");
|
|
});
|
|
|
|
it("never accepts True-Client-Ip without a verified peer and falls back to X-Real-IP", () => {
|
|
expect(getTrustedClientIp(req({ "true-client-ip": "198.51.100.7" }))).toBe("unknown");
|
|
expect(getTrustedClientIp(req({ "x-real-ip": "198.51.100.8" }))).toBe("198.51.100.8");
|
|
});
|
|
|
|
it("ignores non-IP trusted-header values and returns unknown when nothing valid is present", () => {
|
|
expect(getTrustedClientIp(req({ "cf-connecting-ip": "not-an-ip" }))).toBe("unknown");
|
|
expect(getTrustedClientIp(req({ "cf-connecting-ip": "203.0.113.7" }))).toBe("unknown");
|
|
expect(getTrustedClientIp(req({}))).toBe("unknown");
|
|
});
|
|
});
|