Trust reverse proxy client IP headers

tests/test_security.py

@@ -268,6 +268,67 @@ def test_trusted_proxy_uses_cloudflare_connecting_ip(tmp_path: Path) -> None:
     assert response.json()["ip"] == "198.51.100.20"
 
 
+def test_private_reverse_proxy_uses_cloudflare_connecting_ip_by_default(tmp_path: Path) -> None:
+    settings = DdnsSettings(
+        database_path=tmp_path / "ddns.sqlite3",
+        admin_password="admin",
+    )
+    app = make_app(settings)
+
+    @app.get("/debug-ip", include_in_schema=False)
+    def debug_ip(request: Request) -> dict[str, str]:
+        return {"ip": client_ip(request, settings)}
+
+    client = TestClient(app, client=("172.18.0.5", 12345))
+    response = client.get(
+        "/debug-ip",
+        headers={
+            "cf-connecting-ip": "8.8.8.8",
+            "x-forwarded-for": "1.1.1.1",
+        },
+    )
+
+    assert response.status_code == 200
+    assert response.json()["ip"] == "8.8.8.8"
+
+
+def test_private_reverse_proxy_uses_forwarded_for_without_cloudflare_header(tmp_path: Path) -> None:
+    settings = DdnsSettings(
+        database_path=tmp_path / "ddns.sqlite3",
+        admin_password="admin",
+    )
+    app = make_app(settings)
+
+    @app.get("/debug-ip", include_in_schema=False)
+    def debug_ip(request: Request) -> dict[str, str]:
+        return {"ip": client_ip(request, settings)}
+
+    client = TestClient(app, client=("172.18.0.5", 12345))
+    response = client.get("/debug-ip", headers={"x-forwarded-for": "8.8.4.4, 172.18.0.5"})
+
+    assert response.status_code == 200
+    assert response.json()["ip"] == "8.8.4.4"
+
+
+def test_private_reverse_proxy_trust_can_be_disabled(tmp_path: Path) -> None:
+    settings = DdnsSettings(
+        database_path=tmp_path / "ddns.sqlite3",
+        admin_password="admin",
+        trust_private_proxy_headers=False,
+    )
+    app = make_app(settings)
+
+    @app.get("/debug-ip", include_in_schema=False)
+    def debug_ip(request: Request) -> dict[str, str]:
+        return {"ip": client_ip(request, settings)}
+
+    client = TestClient(app, client=("172.18.0.5", 12345))
+    response = client.get("/debug-ip", headers={"cf-connecting-ip": "8.8.8.8"})
+
+    assert response.status_code == 200
+    assert response.json()["ip"] == "172.18.0.5"
+
+
 def test_untrusted_proxy_headers_are_ignored(tmp_path: Path) -> None:
     settings = DdnsSettings(
         database_path=tmp_path / "ddns.sqlite3",