xfy
b5c3c0954f
Security: - Enforce client_max_body_size in HTTP/2 and HTTP/3 adapters before buffering - Use trusted-proxy-aware client IP extraction for access control and rate limiting - Include Host and Vary headers in proxy cache key to prevent cache poisoning - Harden static file path traversal check with filepath.Clean + prefix validation - Honor proxy_ssl config for WebSocket upstream TLS Proxy/handler bugs: - Decrement WebSocket connection count immediately on return (not deferred in retry loop) - Remove ineffective headersPool - Coalesce concurrent background cache refreshes with singleflight Dev/build: - Fix Makefile run and test-config targets - Remove broken wget healthcheck from docker-compose - Add missing integration build tags - Fix go vet warnings in tests CI: - Run golangci-lint and integration tests in Gitea Actions Refs: docs/superpowers/plans/2026-06-17-fix-review-issues.md
29 lines
667 B
Go
29 lines
667 B
Go
package proxy
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"github.com/valyala/fasthttp"
|
|
)
|
|
|
|
func TestBuildCacheKeyIncludesHostAndVary(t *testing.T) {
|
|
p := &Proxy{}
|
|
ctx1 := &fasthttp.RequestCtx{}
|
|
ctx1.Request.Header.SetMethod("GET")
|
|
ctx1.Request.Header.SetHost("a.example.com")
|
|
ctx1.Request.SetRequestURI("/api/data")
|
|
|
|
ctx2 := &fasthttp.RequestCtx{}
|
|
ctx2.Request.Header.SetMethod("GET")
|
|
ctx2.Request.Header.SetHost("b.example.com")
|
|
ctx2.Request.SetRequestURI("/api/data")
|
|
|
|
vary := []string{"Accept-Encoding"}
|
|
h1, key1 := p.buildCacheKeyHash(ctx1, vary)
|
|
h2, key2 := p.buildCacheKeyHash(ctx2, vary)
|
|
|
|
if h1 == h2 || key1 == key2 {
|
|
t.Fatal("cache keys must differ by Host")
|
|
}
|
|
}
|