fix

2026-08-17 21:20:45 +02:00
parent 321f11e817
commit 6fcdc74843
157 changed files with 2895 additions and 7544 deletions
@@ -134,3 +134,17 @@ func TestGateAllowsPublicFlagInProduction(t *testing.T) {
 		t.Fatalf("METRICS_PUBLIC status=%d", rec.Code)
 	}
 }
+
+func TestGateBlocksSpoofedLoopbackXFFInProduction(t *testing.T) {
+	t.Cleanup(Reset)
+	Reset()
+	h := Gate(true, false)(Handler())
+	req := httptest.NewRequest(http.MethodGet, "/metrics", nil)
+	req.RemoteAddr = "127.0.0.1:54321"
+	req.Header.Set("X-Forwarded-For", "127.0.0.1")
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != http.StatusNotFound {
+		t.Fatalf("spoofed XFF loopback status=%d want 404", rec.Code)
+	}
+}