Initial commit on Forgejo

Fresh repository history for elektrine/tarakan hosted at
https://git.elektrine.com/elektrine/tarakan.

test/tarakan_web/plugs/forwarded_proto_test.exs

@@ -0,0 +1,75 @@
+defmodule TarakanWeb.Plugs.ForwardedProtoTest do
+  use ExUnit.Case, async: false
+
+  import Plug.Conn
+  import Plug.Test
+
+  alias Tarakan.TrustedProxies
+  alias TarakanWeb.Plugs.ForwardedProto
+
+  setup do
+    previous = Application.get_env(:tarakan, :trusted_proxies, [])
+
+    on_exit(fn ->
+      Application.put_env(:tarakan, :trusted_proxies, previous)
+    end)
+
+    :ok
+  end
+
+  test "rewrites the scheme when the peer is a trusted proxy" do
+    Application.put_env(:tarakan, :trusted_proxies, TrustedProxies.parse("127.0.0.1,::1"))
+
+    conn =
+      conn(:get, "/")
+      |> Map.put(:remote_ip, {127, 0, 0, 1})
+      |> put_req_header("x-forwarded-proto", "https")
+      |> ForwardedProto.call([])
+
+    assert conn.scheme == :https
+
+    conn =
+      conn(:get, "/")
+      |> Map.put(:remote_ip, {0, 0, 0, 0, 0, 0, 0, 1})
+      |> Map.put(:scheme, :https)
+      |> put_req_header("x-forwarded-proto", "http")
+      |> ForwardedProto.call([])
+
+    assert conn.scheme == :http
+  end
+
+  test "ignores X-Forwarded-Proto from untrusted peers" do
+    Application.put_env(:tarakan, :trusted_proxies, TrustedProxies.parse("10.0.0.0/8"))
+
+    conn =
+      conn(:get, "/")
+      |> Map.put(:remote_ip, {198, 51, 100, 1})
+      |> put_req_header("x-forwarded-proto", "https")
+      |> ForwardedProto.call([])
+
+    assert conn.scheme == :http
+  end
+
+  test "ignores X-Forwarded-Proto without configured proxies" do
+    Application.put_env(:tarakan, :trusted_proxies, [])
+
+    conn =
+      conn(:get, "/")
+      |> Map.put(:remote_ip, {127, 0, 0, 1})
+      |> put_req_header("x-forwarded-proto", "https")
+      |> ForwardedProto.call([])
+
+    assert conn.scheme == :http
+  end
+
+  test "leaves the scheme untouched without the header" do
+    Application.put_env(:tarakan, :trusted_proxies, TrustedProxies.parse("127.0.0.1"))
+
+    conn =
+      conn(:get, "/")
+      |> Map.put(:remote_ip, {127, 0, 0, 1})
+      |> ForwardedProto.call([])
+
+    assert conn.scheme == :http
+  end
+end