test(middleware): add integration tests for rate-limiter spoofing prevention#6686
Conversation
|
@dinesh9997 is attempting to deploy a commit to the jhasourav07's projects Team on Vercel. A member of the Team first needs to authorize it. |
📦 Next.js Bundle Size Report (Gzipped Sizes)✨ No significant bundle size changes detected. 📊 Summary of Totals
|
Aamod007
left a comment
There was a problem hiding this comment.
Hello! Thanks for this detailed testing PR. I love the rigor here—testing these rate-limiter spoofing scenarios is crucial for our API security.
I'm assigning level:intermediate because this involves some advanced Vitest mocking (like �i.hoisted) and complex proxy scenarios. I'm also adding quality:exceptional because these tests are extremely well-documented and cover all the edge cases perfectly! Since this directly impacts our test coverage and security guarantees, I'm adding ype:testing and ype:security as well.
Awesome work locking this down!
|
🎉 Congratulations @dinesh9997! Your PR has been successfully merged. 🚀 Thank you for contributing to CommitPulse. Your work helps us build a better tool for the community.
Keep building! 💻✨ |
…ing prevention (JhaSourav07#6686) ## Description Resolves JhaSourav07#6039 This PR adds a comprehensive integration test suite to verify the rate-limiting middleware's request spoofing prevention checks. Rather than testing with fully mocked responses, these tests run under realistic HTTP request flows using the actual rate-limiting cache layer to ensure rate limits cannot be bypassed by manipulating the `X-Forwarded-For` or `X-Real-IP` headers. ## Summary of Changes - **Conditional Mock Bypass in [middleware.test.ts](file:///c:/Users/gsspa/OneDrive/Desktop/Gssoc%20project/CommitPulse/middleware.test.ts):** - Updated the top-level `vi.mock` for `@/lib/rate-limit` to support a `useRealRateLimit` flag. - When `useRealRateLimit = true`, the mocks dynamically delegate to the actual `rateLimit` and `getRateLimitHeaders` implementations. - Standardized mock resets to prevent mock bleeding between unit and integration test blocks. - **Added Integration Scenarios:** - **Scenario 1 (Default - No trusted proxies):** Verifies that client-supplied `X-Forwarded-For` headers are ignored when no trust is established, and the rate limit applies strictly to the default connection IP. Rotating spoofed headers does not bypass the rate limit. - **Scenario 2 (Wildcard trust - `TRUSTED_PROXIES=*` / `VERCEL=1`):** Verifies that the leftmost IP in `X-Forwarded-For` is resolved as the client IP, and rate-limiting is enforced on it accordingly. - **Scenario 3 (Custom trusted proxies):** Verifies that headers are rejected and resolved to the default IP when no direct peer socket IP is established. - **State Isolation:** - Integrated `vi.useFakeTimers` with a progressive test time advancement (`120,000ms` forward before each test) to ensure the local rate-limiter cache expires naturally between test runs. ## Testing & Verification All unit and new integration tests pass successfully: ```bash npx vitest run middleware.test.ts npx eslint middleware.test.ts npx prettier --check middleware.test.ts
Description
Resolves #6039
This PR adds a comprehensive integration test suite to verify the rate-limiting middleware's request spoofing prevention checks. Rather than testing with fully mocked responses, these tests run under realistic HTTP request flows using the actual rate-limiting cache layer to ensure rate limits cannot be bypassed by manipulating the
X-Forwarded-FororX-Real-IPheaders.Summary of Changes
vi.mockfor@/lib/rate-limitto support auseRealRateLimitflag.useRealRateLimit = true, the mocks dynamically delegate to the actualrateLimitandgetRateLimitHeadersimplementations.X-Forwarded-Forheaders are ignored when no trust is established, and the rate limit applies strictly to the default connection IP. Rotating spoofed headers does not bypass the rate limit.TRUSTED_PROXIES=*/VERCEL=1): Verifies that the leftmost IP inX-Forwarded-Foris resolved as the client IP, and rate-limiting is enforced on it accordingly.vi.useFakeTimerswith a progressive test time advancement (120,000msforward before each test) to ensure the local rate-limiter cache expires naturally between test runs.Testing & Verification
All unit and new integration tests pass successfully: