Sekai/hado
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: trust X-Remote-User only from the proxy (HADO_TRUSTED_PROXIES); open tailnet inbound for the agent

Browse Source 
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BCrwHHnGCB5XH968Nxokqw
This commit is contained in:
nikita.hohlov
2026-09-05 07:25:31 -03:00
parent 36d6af659e
commit bc82bbab19
5 changed files with 40 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
core/tests/Feature/RemoteUserTrustTest.php Normal file
View File

@@ -0,0 +1,25 @@
<?php
namespace Tests\Feature;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Tests\TestCase;
/** X-Remote-User верим только соседу по докер-сети (Caddy); с тейлнета или снаружи заголовок — не пропуск. */
class RemoteUserTrustTest extends TestCase
{
use RefreshDatabase;
public function test_header_is_trusted_from_docker_bridge_and_loopback(): void
{
$this->withServerVariables(['REMOTE_ADDR' => '172.21.0.1'])->getJson('/me', ['X-Remote-User' => 'luci'])->assertOk();
$this->withServerVariables(['REMOTE_ADDR' => '127.0.0.1'])->getJson('/me', ['X-Remote-User' => 'luci'])->assertOk();
}
public function test_header_from_tailnet_or_internet_is_rejected(): void
{
$this->withServerVariables(['REMOTE_ADDR' => '100.124.15.61'])->getJson('/me', ['X-Remote-User' => 'luci'])
->assertStatus(401)->assertJsonPath('message', 'X-Remote-User принимается только от прокси');
$this->withServerVariables(['REMOTE_ADDR' => '8.8.8.8'])->getJson('/me', ['X-Remote-User' => 'luci'])->assertStatus(401);
}
}