84 lines
2.8 KiB
C#
84 lines
2.8 KiB
C#
using System.Net;
|
|
using Microsoft.AspNetCore.HttpOverrides;
|
|
using Omika.Api;
|
|
|
|
namespace Omika.Tests.Api;
|
|
|
|
/// <summary>
|
|
/// Tests de la configuration ForwardedHeaders (reverse proxy Apache local).
|
|
/// Vérifient le contenu exact des options (en-têtes, ForwardLimit, KnownProxies)
|
|
/// et l'absence de toute configuration « trust-all » (symétrie conservée,
|
|
/// KnownNetworks jamais vidé, aucun proxy non-loopback).
|
|
/// </summary>
|
|
public class ForwardedHeadersConfigurationTests
|
|
{
|
|
[Fact]
|
|
public void CreateOptions_ConfiguresForwardedHeaders()
|
|
{
|
|
var options = ForwardedHeadersConfiguration.CreateOptions();
|
|
|
|
Assert.Equal(
|
|
ForwardedHeaders.XForwardedFor
|
|
| ForwardedHeaders.XForwardedProto
|
|
| ForwardedHeaders.XForwardedHost,
|
|
options.ForwardedHeaders);
|
|
}
|
|
|
|
[Fact]
|
|
public void CreateOptions_SetsForwardLimitToOne()
|
|
{
|
|
var options = ForwardedHeadersConfiguration.CreateOptions();
|
|
|
|
Assert.Equal(1, options.ForwardLimit);
|
|
}
|
|
|
|
[Fact]
|
|
public void CreateOptions_AddsIpv4LoopbackAsKnownProxy()
|
|
{
|
|
var options = ForwardedHeadersConfiguration.CreateOptions();
|
|
|
|
Assert.Contains(IPAddress.Loopback, options.KnownProxies);
|
|
}
|
|
|
|
[Fact]
|
|
public void CreateOptions_AddsIpv6LoopbackAsKnownProxy()
|
|
{
|
|
var options = ForwardedHeadersConfiguration.CreateOptions();
|
|
|
|
Assert.Contains(IPAddress.IPv6Loopback, options.KnownProxies);
|
|
}
|
|
|
|
[Fact]
|
|
public void CreateOptions_OnlyTrustsLoopbackProxies()
|
|
{
|
|
var options = ForwardedHeadersConfiguration.CreateOptions();
|
|
|
|
// Aucun wildcard (0.0.0.0 / [::]) : uniquement le proxy Apache local.
|
|
Assert.DoesNotContain(IPAddress.Any, options.KnownProxies);
|
|
Assert.DoesNotContain(IPAddress.IPv6Any, options.KnownProxies);
|
|
Assert.All(options.KnownProxies, ip => Assert.True(IPAddress.IsLoopback(ip)));
|
|
}
|
|
|
|
[Fact]
|
|
public void CreateOptions_KeepsRequireHeaderSymmetryEnabled()
|
|
{
|
|
var options = ForwardedHeadersConfiguration.CreateOptions();
|
|
|
|
// La symétrie des en-têtes reste activée (défaut sécurisé) : jamais
|
|
// désactivée pour une configuration permissive globale.
|
|
Assert.True(options.RequireHeaderSymmetry);
|
|
}
|
|
|
|
[Fact]
|
|
public void CreateOptions_DoesNotClearKnownNetworks()
|
|
{
|
|
var options = ForwardedHeadersConfiguration.CreateOptions();
|
|
|
|
// KnownIPNetworks (anciennement KnownNetworks) conserve ses réseaux par
|
|
// défaut (loopback) : jamais vidé.
|
|
Assert.NotEmpty(options.KnownIPNetworks);
|
|
// La confiance réseau reste bornée au loopback (127.0.0.1/8 et ::1/128).
|
|
Assert.All(options.KnownIPNetworks, network => Assert.True(IPAddress.IsLoopback(network.BaseAddress)));
|
|
}
|
|
}
|