103 lines
4.5 KiB
C#
103 lines
4.5 KiB
C#
using Microsoft.AspNetCore.Mvc.Testing;
|
|
using Microsoft.Extensions.Configuration;
|
|
|
|
namespace ItWorx.KnowledgeHub.Api.Tests;
|
|
|
|
/// <summary>
|
|
/// Proves the reverse-proxy trust boundary documented in
|
|
/// docs/23-deployment-unraid.md "Reverse proxy" and EVIDENCE.md's "Production
|
|
/// configuration" item: forwarded headers (X-Forwarded-Proto) are only honored when
|
|
/// they arrive from an explicitly configured KnowledgeHub:TrustedProxies entry, never
|
|
/// by default and never from an untrusted source. The CSRF cookie's
|
|
/// CookieSecurePolicy.SameAsRequest makes the resulting "Secure" attribute a direct,
|
|
/// observable proxy for whether ASP.NET Core actually treated the request as HTTPS.
|
|
/// </summary>
|
|
public sealed class ForwardedHeadersTrustTests
|
|
{
|
|
private const string SimulatedRemoteIp = "203.0.113.7";
|
|
|
|
// WebApplicationFactory.CreateClient() defaults its base address to https://localhost,
|
|
// which alone already makes TestServer report Request.IsHttps == true — independent of
|
|
// any forwarded header. Every test below forces an http:// base address instead, so the
|
|
// "Secure" cookie attribute genuinely reflects whether the ForwardedHeaders middleware
|
|
// honored (or correctly ignored) X-Forwarded-Proto, not this client default.
|
|
private static readonly WebApplicationFactoryClientOptions HttpClientOptions = new()
|
|
{
|
|
BaseAddress = new Uri("http://localhost"),
|
|
};
|
|
|
|
[Fact]
|
|
public async Task An_untrusted_X_Forwarded_Proto_header_is_ignored_by_default()
|
|
{
|
|
using var factory = new KnowledgeHubApiFactory();
|
|
using var client = factory.CreateClient(HttpClientOptions);
|
|
|
|
var csrfCookie = await GetCsrfCookieAsync(client, SimulatedRemoteIp);
|
|
|
|
Assert.DoesNotContain("Secure", csrfCookie, StringComparison.OrdinalIgnoreCase);
|
|
}
|
|
|
|
[Fact]
|
|
public async Task An_X_Forwarded_Proto_header_from_a_configured_trusted_proxy_is_honored()
|
|
{
|
|
using var factory = new KnowledgeHubApiFactory().WithWebHostBuilder(builder =>
|
|
{
|
|
builder.ConfigureAppConfiguration((_, configuration) =>
|
|
{
|
|
configuration.AddInMemoryCollection(new Dictionary<string, string?>
|
|
{
|
|
["KnowledgeHub:TrustedProxies"] = $"{SimulatedRemoteIp};127.0.0.1",
|
|
});
|
|
});
|
|
});
|
|
using var client = factory.CreateClient(HttpClientOptions);
|
|
|
|
var csrfCookie = await GetCsrfCookieAsync(client, SimulatedRemoteIp);
|
|
|
|
Assert.Contains("Secure", csrfCookie, StringComparison.OrdinalIgnoreCase);
|
|
}
|
|
|
|
[Fact]
|
|
public async Task A_trusted_proxy_list_that_does_not_include_the_caller_still_ignores_the_header()
|
|
{
|
|
using var factory = new KnowledgeHubApiFactory().WithWebHostBuilder(builder =>
|
|
{
|
|
builder.ConfigureAppConfiguration((_, configuration) =>
|
|
{
|
|
// A real trusted proxy is configured, but it is not the address this
|
|
// request actually arrives from — the header must still be ignored.
|
|
configuration.AddInMemoryCollection(new Dictionary<string, string?>
|
|
{
|
|
["KnowledgeHub:TrustedProxies"] = "198.51.100.9",
|
|
});
|
|
});
|
|
});
|
|
using var client = factory.CreateClient(HttpClientOptions);
|
|
|
|
var csrfCookie = await GetCsrfCookieAsync(client, SimulatedRemoteIp);
|
|
|
|
Assert.DoesNotContain("Secure", csrfCookie, StringComparison.OrdinalIgnoreCase);
|
|
}
|
|
|
|
private static async Task<string> GetCsrfCookieAsync(HttpClient client, string simulatedRemoteIp)
|
|
{
|
|
using var request = new HttpRequestMessage(HttpMethod.Get, "/api/v1/auth/csrf");
|
|
// TestServer never simulates a real socket, so Connection.RemoteIpAddress is null
|
|
// unless something sets it. Program.cs sets it from this header in the Test
|
|
// environment only (never reachable in Production), giving the KnownProxies
|
|
// trust check a deterministic "direct caller" address — the same role a real
|
|
// kernel-level TCP accept plays in production.
|
|
request.Headers.Add("X-Test-Remote-Ip", simulatedRemoteIp);
|
|
request.Headers.Add("X-Forwarded-Proto", "https");
|
|
request.Headers.Add("X-Forwarded-For", "198.51.100.50");
|
|
|
|
using var response = await client.SendAsync(request);
|
|
|
|
var csrfCookie = response.Headers.TryGetValues("Set-Cookie", out var values)
|
|
? values.FirstOrDefault(v => v.StartsWith("ikh_csrf=", StringComparison.Ordinal))
|
|
: null;
|
|
Assert.NotNull(csrfCookie);
|
|
return csrfCookie;
|
|
}
|
|
}
|