Nick SzaunigandClaude Opus 5.5
0d254db867
Docker Image bauen und veroeffentlichen / build-and-push (push) Successful in 4m59s
CF-Connecting-IP wird nur noch als öffentliche Unicast-Adresse akzeptiert (kein 0/8, 10/8, 100.64/10, 127/8, 169.254/16, 172.16/12, 192.168/16, 240/4 "Pseudo IPv4", 255.255.255.255, ::, ::1, fc00::/7, fe80::/10 sowie IPv4-gemappte Formen); sonst gilt die Gegenstelle aus X-Forwarded-For. Der X-Real-IP-Fallback gilt nur noch außerhalb von Produktion. In Produktion ohne X-Forwarded-For wird "unknown" geliefert. Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
73 lines
3.5 KiB
TypeScript
73 lines
3.5 KiB
TypeScript
import { afterEach, describe, expect, it, vi } from "vitest";
|
|
import { rateLimitSubject, resolveClientIp } from "./rate-limit";
|
|
|
|
const h = (values: Record<string, string>) => new Headers(values);
|
|
|
|
afterEach(() => {
|
|
vi.unstubAllEnvs();
|
|
});
|
|
|
|
describe("resolveClientIp (Client-IP hinter Cloudflare und Traefik)", () => {
|
|
it("nimmt den letzten X-Forwarded-For-Eintrag, nie einen vom Client gesetzten", () => {
|
|
expect(resolveClientIp(h({ "x-forwarded-for": "1.2.3.4, 198.51.100.9" }))).toBe("198.51.100.9");
|
|
});
|
|
|
|
it("nimmt CF-Connecting-IP, wenn die Gegenstelle eine Cloudflare-Edge ist", () => {
|
|
const viaCloudflare = { "x-forwarded-for": "1.2.3.4, 203.0.113.7, 172.70.1.2", "cf-connecting-ip": "203.0.113.7" };
|
|
expect(resolveClientIp(h(viaCloudflare))).toBe("203.0.113.7");
|
|
expect(resolveClientIp(h({ "x-forwarded-for": "2606:4700:10::1", "cf-connecting-ip": "2001:db8::5" }))).toBe("2001:db8::5");
|
|
});
|
|
|
|
it("ignoriert CF-Connecting-IP bei direktem Zugriff an Cloudflare vorbei", () => {
|
|
expect(resolveClientIp(h({ "x-forwarded-for": "198.51.100.9", "cf-connecting-ip": "203.0.113.7" }))).toBe("198.51.100.9");
|
|
});
|
|
|
|
it("fällt ohne X-Forwarded-For außerhalb von Produktion auf X-Real-IP zurück, sonst „unknown“", () => {
|
|
vi.stubEnv("NODE_ENV", "development");
|
|
expect(resolveClientIp(h({ "x-real-ip": "198.51.100.9" }))).toBe("198.51.100.9");
|
|
expect(resolveClientIp(h({}))).toBe("unknown");
|
|
});
|
|
|
|
it("ignoriert X-Real-IP in Produktion, wenn X-Forwarded-For fehlt", () => {
|
|
vi.stubEnv("NODE_ENV", "production");
|
|
expect(resolveClientIp(h({ "x-real-ip": "198.51.100.9" }))).toBe("unknown");
|
|
expect(resolveClientIp(h({ "x-forwarded-for": "198.51.100.9", "x-real-ip": "203.0.113.1" }))).toBe("198.51.100.9");
|
|
});
|
|
|
|
describe("CF-Connecting-IP nur als öffentliche Unicast-Adresse", () => {
|
|
const edge = "172.70.1.2";
|
|
const nonPublic = [
|
|
"0.0.0.0", "0.1.2.3", "10.0.0.1", "100.64.0.1", "100.127.255.255", "127.0.0.1", "169.254.1.1",
|
|
"172.16.0.1", "172.31.255.255", "192.168.1.1", "240.0.0.1", "255.255.255.255",
|
|
"::", "::1", "fc00::1", "fd12:3456::1", "fe80::1", "febf::1",
|
|
"::ffff:10.0.0.1", "::ffff:127.0.0.1", "::ffff:192.168.1.1", "::ffff:240.0.0.1", "::ffff:0.0.0.0",
|
|
];
|
|
|
|
it.each(nonPublic)("verwirft %s und nutzt die Cloudflare-Edge als Gegenstelle", (ip) => {
|
|
expect(resolveClientIp(h({ "x-forwarded-for": edge, "cf-connecting-ip": ip }))).toBe(edge);
|
|
});
|
|
|
|
it.each(["203.0.113.7", "100.63.255.255", "172.32.0.1", "239.1.1.1", "2001:db8::5", "::ffff:203.0.113.7"])(
|
|
"akzeptiert öffentliche Adresse %s",
|
|
(ip) => {
|
|
expect(resolveClientIp(h({ "x-forwarded-for": edge, "cf-connecting-ip": ip }))).toBe(ip);
|
|
},
|
|
);
|
|
});
|
|
});
|
|
|
|
describe("rateLimitSubject (IPv6 je /64)", () => {
|
|
it("fasst alle Adressen eines /64-Netzes zusammen, sonst ließe sich jedes Limit durch Adresswechsel umgehen", () => {
|
|
expect(rateLimitSubject("2001:db8:1:2::1")).toBe("2001:db8:1:2::/64");
|
|
expect(rateLimitSubject("2001:db8:1:2:aaaa:bbbb:cccc:dddd")).toBe("2001:db8:1:2::/64");
|
|
expect(rateLimitSubject("2001:0DB8:0001:0002:ffff:ffff:ffff:ffff")).toBe("2001:db8:1:2::/64");
|
|
expect(rateLimitSubject("2001:db8:1:3::1")).not.toBe(rateLimitSubject("2001:db8:1:2::1"));
|
|
});
|
|
|
|
it("lässt IPv4 unverändert und behandelt IPv4-gemappte Adressen wie IPv4", () => {
|
|
expect(rateLimitSubject("198.51.100.9")).toBe("198.51.100.9");
|
|
expect(rateLimitSubject("::ffff:198.51.100.9")).toBe("198.51.100.9");
|
|
expect(rateLimitSubject("unknown")).toBe("unknown");
|
|
});
|
|
});
|