From c259b91e69df9816183df89eb15998d11d069e58 Mon Sep 17 00:00:00 2001 From: Meta Vens Date: Sat, 10 Oct 2026 05:39:16 +0200 Subject: [PATCH] HostTrustTests: pin the forward limit and the exact-loopback trust set Co-Authored-By: Claude Opus 5.5 --- tests/Bifrost.Web.Tests/HostTrustTests.cs | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/tests/Bifrost.Web.Tests/HostTrustTests.cs b/tests/Bifrost.Web.Tests/HostTrustTests.cs index 99f8676..0c4e201 100644 --- a/tests/Bifrost.Web.Tests/HostTrustTests.cs +++ b/tests/Bifrost.Web.Tests/HostTrustTests.cs @@ -53,6 +53,22 @@ public sealed class HostTrustTests : IClassFixture Assert.Equal(IPAddress.Parse("203.0.113.7"), context.Connection.RemoteIpAddress); } + [Fact] + public async Task A_loopback_forwarded_entry_does_not_chain_to_earlier_entries() + { + var context = await RunForwardedHeaders("127.0.0.1", "6.6.6.6, 127.0.0.1", null); + + Assert.Equal(IPAddress.Loopback, context.Connection.RemoteIpAddress); + } + + [Fact] + public async Task Only_the_exact_loopback_addresses_are_trusted_not_the_loopback_range() + { + var context = await RunForwardedHeaders("127.0.0.2", "203.0.113.7", null); + + Assert.Equal(IPAddress.Parse("127.0.0.2"), context.Connection.RemoteIpAddress); + } + [Fact] public void Payload_protected_under_one_content_root_unprotects_under_another() {