Something went wrong. Try again.
[READ-ONLY] Mirror of https://github.com/openstatusHQ/openstatus. 🫖 Status page with uptime monitoring & API monitoring as code 🫖 openstatus.dev
bun drizzle-orm monitoring monitoring-as-code nextjs observability on-call open-source shadcn-ui status-page statuspage synthetic-monitoring tinybird turso uptime uptime-checker uptime-monitor
Something went wrong. Try again.
1.1 kB · 40 lines
TypeScript
1234567891011121314151617181920212223242526272829303132333435363738394041import { expect } from "@std/expect";import { describe, test } from "@std/testing/bdd";
import { resolveClientIp } from "./client-ip";
function h(map: Record<string, string>) { return { get: (name: string) => map[name] ?? null };}
describe("resolveClientIp", () => { test("prefers x-real-ip over x-forwarded-for", () => { expect( resolveClientIp( h({ "x-real-ip": "9.9.9.9", "x-forwarded-for": "1.2.3.4" }), ), ).toBe("9.9.9.9"); });
test("ignores a spoofed leftmost x-forwarded-for when x-real-ip is present", () => { // Attacker injects an allowed IP at the head of the chain; x-real-ip wins. expect( resolveClientIp( h({ "x-real-ip": "203.0.113.7", "x-forwarded-for": "10.0.0.1, 203.0.113.7", }), ), ).toBe("203.0.113.7"); });
test("falls back to leftmost x-forwarded-for when x-real-ip is absent", () => { expect(resolveClientIp(h({ "x-forwarded-for": "1.2.3.4, 5.6.7.8" }))).toBe( "1.2.3.4", ); });
test("returns null when neither header is present", () => { expect(resolveClientIp(h({}))).toBeNull(); });});