From 67c4f6a1ad2108004e780ab30132dce03c915c1f Mon Sep 17 00:00:00 2001 From: root Date: Sat, 25 Apr 2026 15:14:02 +0800 Subject: [PATCH] fix: update rate limit tests to use CF-Connecting-IP header The middleware was changed to trust CF-Connecting-IP instead of X-Real-IP/X-Forwarded-For, but the tests still used the old headers. TestRateLimitMiddleware_DifferentIPsIndependent was failing because all requests fell back to the same httptest RemoteAddr. Co-Authored-By: Claude Opus 4.6 --- web/middleware/middleware_test.go | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/web/middleware/middleware_test.go b/web/middleware/middleware_test.go index 0e9c5bdc..d87620c6 100644 --- a/web/middleware/middleware_test.go +++ b/web/middleware/middleware_test.go @@ -238,7 +238,7 @@ func TestRateLimitMiddleware_ExceedsLimit(t *testing.T) { } } -func TestRateLimitMiddleware_XRealIP(t *testing.T) { +func TestRateLimitMiddleware_CFConnectingIP(t *testing.T) { r := gin.New() r.Use(RateLimitMiddleware(2, time.Minute)) r.GET("/test", func(c *gin.Context) { @@ -248,21 +248,21 @@ func TestRateLimitMiddleware_XRealIP(t *testing.T) { for range 2 { w := httptest.NewRecorder() req, _ := http.NewRequest("GET", "/test", nil) - req.Header.Set("X-Real-IP", "10.0.0.1") + req.Header.Set("CF-Connecting-IP", "10.0.0.1") r.ServeHTTP(w, req) } w := httptest.NewRecorder() req, _ := http.NewRequest("GET", "/test", nil) - req.Header.Set("X-Real-IP", "10.0.0.1") + req.Header.Set("CF-Connecting-IP", "10.0.0.1") r.ServeHTTP(w, req) if w.Code != http.StatusTooManyRequests { - t.Errorf("expected 429 with X-Real-IP, got %d", w.Code) + t.Errorf("expected 429 with CF-Connecting-IP, got %d", w.Code) } } -func TestRateLimitMiddleware_XForwardedFor(t *testing.T) { +func TestRateLimitMiddleware_RemoteAddr(t *testing.T) { r := gin.New() r.Use(RateLimitMiddleware(2, time.Minute)) r.GET("/test", func(c *gin.Context) { @@ -272,17 +272,17 @@ func TestRateLimitMiddleware_XForwardedFor(t *testing.T) { for range 2 { w := httptest.NewRecorder() req, _ := http.NewRequest("GET", "/test", nil) - req.Header.Set("X-Forwarded-For", "10.0.0.2, 10.0.0.3") + req.RemoteAddr = "10.0.0.2:12345" r.ServeHTTP(w, req) } w := httptest.NewRecorder() req, _ := http.NewRequest("GET", "/test", nil) - req.Header.Set("X-Forwarded-For", "10.0.0.2, 10.0.0.3") + req.RemoteAddr = "10.0.0.2:12345" r.ServeHTTP(w, req) if w.Code != http.StatusTooManyRequests { - t.Errorf("expected 429 with X-Forwarded-For, got %d", w.Code) + t.Errorf("expected 429 with RemoteAddr, got %d", w.Code) } } @@ -296,12 +296,12 @@ func TestRateLimitMiddleware_DifferentIPsIndependent(t *testing.T) { // Exhaust limit for IP 1 w := httptest.NewRecorder() req, _ := http.NewRequest("GET", "/test", nil) - req.Header.Set("X-Real-IP", "10.0.0.10") + req.Header.Set("CF-Connecting-IP", "10.0.0.10") r.ServeHTTP(w, req) w = httptest.NewRecorder() req, _ = http.NewRequest("GET", "/test", nil) - req.Header.Set("X-Real-IP", "10.0.0.10") + req.Header.Set("CF-Connecting-IP", "10.0.0.10") r.ServeHTTP(w, req) if w.Code != http.StatusTooManyRequests { @@ -311,7 +311,7 @@ func TestRateLimitMiddleware_DifferentIPsIndependent(t *testing.T) { // IP 2 should still be allowed w = httptest.NewRecorder() req, _ = http.NewRequest("GET", "/test", nil) - req.Header.Set("X-Real-IP", "10.0.0.20") + req.Header.Set("CF-Connecting-IP", "10.0.0.20") r.ServeHTTP(w, req) if w.Code != http.StatusOK {