fix(security): trusted-proxy-scoped login rate limit

2026-09-07 12:44:47 +08:00
parent f7c27272ba
commit 6adbab44c3
5 changed files with 71 additions and 21 deletions
@@ -22,6 +22,7 @@ func TestLoad(t *testing.T) {
 	}
 	t.Setenv("SCAN_INTERVAL_SEC", "30")
 	t.Setenv("DATABASE_URL", "postgres://x")
+	t.Setenv("TRUSTED_PROXY_CIDRS", "")
 	c, err := Load()
 	if err != nil {
 		t.Fatal(err)
@@ -34,4 +35,15 @@ func TestLoad(t *testing.T) {
 	if c.ScanInterval != 30*time.Second || c.BooksDir != wantBooks || c.Addr != ":8080" {
 		t.Fatalf("%+v", c)
 	}
+	if len(c.TrustedProxies) != 1 || c.TrustedProxies[0] != "172.16.0.0/12" {
+		t.Fatalf("trusted proxies default: %+v", c.TrustedProxies)
+	}
+	t.Setenv("TRUSTED_PROXY_CIDRS", "10.0.0.0/8, 1.2.3.4")
+	c, err = Load()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(c.TrustedProxies) != 2 || c.TrustedProxies[0] != "10.0.0.0/8" || c.TrustedProxies[1] != "1.2.3.4" {
+		t.Fatalf("trusted proxies override: %+v", c.TrustedProxies)
+	}
 }