GameCult/Bifrost
Watch
9
0
Fork
You've already forked Bifrost
 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions 1

HostTrustTests: pin the forward limit and the exact-loopback trust set

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Meta Vens 2026-10-10 05:39:16 +02:00
commit c259b91e69
1 changed files with 16 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

16
tests/Bifrost.Web.Tests/HostTrustTests.cs
View file

@ -53,6 +53,22 @@ public sealed class HostTrustTests : IClassFixture<TestWebApplicationFactory>
Assert.Equal(IPAddress.Parse("203.0.113.7"), context.Connection.RemoteIpAddress);
}
[Fact]
public async Task A_loopback_forwarded_entry_does_not_chain_to_earlier_entries()
{
var context = await RunForwardedHeaders("127.0.0.1", "6.6.6.6, 127.0.0.1", null);
Assert.Equal(IPAddress.Loopback, context.Connection.RemoteIpAddress);
}
[Fact]
public async Task Only_the_exact_loopback_addresses_are_trusted_not_the_loopback_range()
{
var context = await RunForwardedHeaders("127.0.0.2", "203.0.113.7", null);
Assert.Equal(IPAddress.Parse("127.0.0.2"), context.Connection.RemoteIpAddress);
}
[Fact]
public void Payload_protected_under_one_content_root_unprotects_under_another()
{