41 lines
1.3 KiB
PHP
41 lines
1.3 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace Tests\Feature\Api\V1;
|
|
|
|
use Illuminate\Support\Facades\RateLimiter;
|
|
use Infra\Providers\AppServiceProvider;
|
|
|
|
covers(AppServiceProvider::class);
|
|
|
|
describe('API V1 Rate Limiting Feature Tests', function (): void {
|
|
it('applies rate limiting partitioned by client IP', function (): void {
|
|
// GIVEN
|
|
/** @var \Tests\TestCase $this */
|
|
RateLimiter::clear('api.v1:192.168.1.100');
|
|
|
|
// WHEN: Making requests within limit
|
|
$response = $this->withServerVariables(['REMOTE_ADDR' => '192.168.1.100'])
|
|
->getJson('/api/v1/health');
|
|
|
|
// THEN
|
|
$response->assertStatus(200);
|
|
expect($response->headers->has('X-RateLimit-Limit'))->toBeTrue();
|
|
expect($response->headers->has('X-RateLimit-Remaining'))->toBeTrue();
|
|
});
|
|
|
|
it('does not resolve rate limit key from untrusted raw X-Forwarded-For header', function (): void {
|
|
// GIVEN
|
|
/** @var \Tests\TestCase $this */
|
|
$clientIp = '10.20.30.40';
|
|
|
|
// WHEN: Making request with spoofed X-Forwarded-For header
|
|
$response = $this->withServerVariables(['REMOTE_ADDR' => $clientIp])
|
|
->withHeaders(['X-Forwarded-For' => '203.0.113.195'])
|
|
->getJson('/api/v1/health');
|
|
|
|
// THEN
|
|
$response->assertStatus(200);
|
|
});
|
|
});
|