37 lines
983 B
TypeScript
37 lines
983 B
TypeScript
 
|
import assert from 'node:assert/strict'
|
||
|
|
import type { FastifyRequest } from 'fastify'
|
||
|
|
import { getClientIp } from '../src/common/http/client-ip'
|
||
|
|
import {
|
||
|
|
assertAuthRateLimit,
|
||
|
|
resetAuthRateLimitForTests,
|
||
|
|
} from '../src/common/rate-limit/auth-rate-limit'
|
||
|
|
|
||
|
|
resetAuthRateLimitForTests()
|
||
|
|
process.env.TRUST_PROXY = 'true'
|
||
|
|
|
||
|
|
const attackerPeer = '203.0.113.99'
|
||
|
|
const req = {
|
||
|
|
socket: { remoteAddress: attackerPeer },
|
||
|
|
headers: { 'x-forwarded-for': 'fresh-spoofed-ip-1' },
|
||
|
|
} as FastifyRequest
|
||
|
|
|
||
|
|
const ip = getClientIp(req)
|
||
|
|
assert.equal(ip, attackerPeer, 'forged XFF must not become rate-limit key')
|
||
|
|
|
||
|
|
for (let i = 0; i < 30; i++) {
|
||
|
|
assertAuthRateLimit(ip)
|
||
|
|
}
|
||
|
|
let blocked = false
|
||
|
|
try {
|
||
|
|
assertAuthRateLimit(ip)
|
||
|
|
blocked = true
|
||
|
|
} catch (error) {
|
||
|
|
assert.equal((error as { status?: number }).status, 429)
|
||
|
|
}
|
||
|
|
assert.equal(blocked, false, 'rate limit must apply to real peer IP')
|
||
|
|
|
||
|
|
resetAuthRateLimitForTests()
|
||
|
|
delete process.env.TRUST_PROXY
|
||
|
|
|
||
|
|
console.log('auth-rate-limit-xff tests passed')
|