diff --git a/server/src/main/java/org/cloudfoundry/identity/uaa/ratelimiting/core/http/RequestInfoImpl.java b/server/src/main/java/org/cloudfoundry/identity/uaa/ratelimiting/core/http/RequestInfoImpl.java index bd169536312..34410be4777 100644 --- a/server/src/main/java/org/cloudfoundry/identity/uaa/ratelimiting/core/http/RequestInfoImpl.java +++ b/server/src/main/java/org/cloudfoundry/identity/uaa/ratelimiting/core/http/RequestInfoImpl.java @@ -38,20 +38,7 @@ public String getAuthorizationHeader() { @Override public String getClientIP() { - String value = header("X-Client-IP"); - if (value == null) { - value = header("X-Real-IP"); - } - if (value == null) { - value = header("X-Forwarded-For"); // Added by the GoRouter - if (value != null) { - int at = value.indexOf(','); - if (at != -1) { - value = StringUtils.stripToNull(value.substring(0, at)); - } - } - } - return value != null ? value : StringUtils.stripToNull(getRemoteAddr()); + return StringUtils.stripToNull(getRemoteAddr()); } public boolean hasHeaderNames() { diff --git a/server/src/test/java/org/cloudfoundry/identity/uaa/ratelimiting/core/http/RequestInfoImplTest.java b/server/src/test/java/org/cloudfoundry/identity/uaa/ratelimiting/core/http/RequestInfoImplTest.java index 0f3ca8e911a..a3cf4039596 100644 --- a/server/src/test/java/org/cloudfoundry/identity/uaa/ratelimiting/core/http/RequestInfoImplTest.java +++ b/server/src/test/java/org/cloudfoundry/identity/uaa/ratelimiting/core/http/RequestInfoImplTest.java @@ -37,6 +37,17 @@ void getAuthorizationHeader() { assertThat(requestInfo.getAuthorizationHeader()).isEqualTo("Mocking Bearer"); } + @Test + void getClientIP_remoteAddr() { + when(mockHSRequest.getHeader("X-Client-IP")).thenReturn("Spoofed-IP-1"); + when(mockHSRequest.getHeader("X-Real-IP")).thenReturn("Spoofed-IP-2"); + when(mockHSRequest.getHeader("X-Forwarded-For")).thenReturn("Spoofed-IP-3"); + when(mockHSRequest.getRemoteAddr()).thenReturn("Mocked-IP-R "); + RequestInfo requestInfo = RequestInfoImpl.from(mockHSRequest); + assertThat(requestInfo).isNotNull(); + assertThat(requestInfo.getClientIP()).isEqualTo("Mocked-IP-R"); + } + @Test void getClientIP_fallsBackToRemoteAddr_whenSpoofableHeadersAbsent() { // Regression: after HeaderFilter strips X-Client-IP and X-Real-IP, rate limiting must @@ -49,36 +60,6 @@ void getClientIP_fallsBackToRemoteAddr_whenSpoofableHeadersAbsent() { assertThat(requestInfo.getClientIP()).isEqualTo("10.0.0.1"); } - @Test - void getClientIP_X_Client() { - when(mockHSRequest.getHeader("X-Client-IP")).thenReturn("Mocked-IP-C "); - when(mockHSRequest.getHeader("X-Real-IP")).thenReturn("Mocked-IP-R "); - when(mockHSRequest.getHeader("X-Forwarded-For")).thenReturn("Mocked-IP-FF0, Mocked-IP-FF1"); - RequestInfo requestInfo = RequestInfoImpl.from(mockHSRequest); - assertThat(requestInfo).isNotNull(); - assertThat(requestInfo.getClientIP()).isEqualTo("Mocked-IP-C"); - } - - @Test - void getClientIP_X_Real() { - when(mockHSRequest.getHeader("X-Client-IP")).thenReturn(" "); - when(mockHSRequest.getHeader("X-Real-IP")).thenReturn("Mocked-IP-R "); - when(mockHSRequest.getHeader("X-Forwarded-For")).thenReturn("Mocked-IP-FF0 , Mocked-IP-FF1"); - RequestInfo requestInfo = RequestInfoImpl.from(mockHSRequest); - assertThat(requestInfo).isNotNull(); - assertThat(requestInfo.getClientIP()).isEqualTo("Mocked-IP-R"); - } - - @Test - void getClientIP_X_Forwarded() { - when(mockHSRequest.getHeader("X-Client-IP")).thenReturn(" "); - when(mockHSRequest.getHeader("X-Real-IP")).thenReturn(" "); - when(mockHSRequest.getHeader("X-Forwarded-For")).thenReturn("Mocked-IP-FF0 , Mocked-IP-FF1"); - RequestInfo requestInfo = RequestInfoImpl.from(mockHSRequest); - assertThat(requestInfo).isNotNull(); - assertThat(requestInfo.getClientIP()).isEqualTo("Mocked-IP-FF0"); - } - @Test void proxyingWorking() { HttpServletRequest mockRequest = mock(HttpServletRequest.class);