packages/angular/ssr/node/test/request_spec.ts - main - githubmirror/angular-cli

packages/angular/ssr/node/test/request_spec.ts
214 строк6 KB
Alan Agius
feat(@angular/ssr): support the standard Forwarded header
23 июн 2026, 11:45
23 июн 2026, 11:457ef9ed2
/**
 * @license
 * Copyright Google LLC All Rights Reserved.
 *
 * Use of this source code is governed by an MIT-style license that can be
 * found in the LICENSE file at https://angular.dev/license
 */

import { IncomingMessage } from 'node:http';
import { Socket } from 'node:net';
import { normalizeTrustProxyHeaders } from '../../src/utils/validation';
import { createRequestUrl } from '../src/request';

// Helper to create a mock request object for testing.
function createRequest(details: {
  headers: Record<string, string | string[] | undefined>;
  encryptedSocket?: boolean;
  url?: string;
  originalUrl?: string;
}): IncomingMessage {
  return {
    headers: details.headers,
    socket: details.encryptedSocket ? ({ encrypted: true } as unknown as Socket) : new Socket(),
    url: details.url,
    originalUrl: details.originalUrl,
  } as unknown as IncomingMessage;
}

describe('createRequestUrl', () => {
  it('should create a http URL with hostname and port from the host header', () => {
    const url = createRequestUrl(
      createRequest({
        headers: { host: 'localhost:8080' },
        url: '/test',
      }),
      new Set(),
    );
    expect(url.href).toBe('http://localhost:8080/test');
  });

  it('should create a https URL when the socket is encrypted', () => {
    const url = createRequestUrl(
      createRequest({
        headers: { host: 'example.com' },
        encryptedSocket: true,
        url: '/test',
      }),
      new Set(),
    );
    expect(url.href).toBe('https://example.com/test');
  });

  it('should use "/" as the path when the URL path is empty', () => {
    const url = createRequestUrl(
      createRequest({
        headers: { host: 'example.com' },
        encryptedSocket: true,
        url: '',
      }),
      new Set(),
    );
    expect(url.href).toBe('https://example.com/');
  });

  it('should preserve query parameters in the URL path', () => {
    const url = createRequestUrl(
      createRequest({
        headers: { host: 'example.com' },
        encryptedSocket: true,
        url: '/test?a=1',
      }),
      new Set(),
    );
    expect(url.href).toBe('https://example.com/test?a=1');
  });

  it('should prioritize "originalUrl" over "url" for the path', () => {
    const url = createRequestUrl(
      createRequest({
        headers: { host: 'example.com' },
        encryptedSocket: true,
        url: '/test',
        originalUrl: '/original',
      }),
      new Set(),
    );
    expect(url.href).toBe('https://example.com/original');
  });

  it('should use "/" as the path when both "url" and "originalUrl" are not provided', () => {
    const url = createRequestUrl(
      createRequest({
        headers: { host: 'example.com' },
        encryptedSocket: true,
        url: undefined,
        originalUrl: undefined,
      }),
      new Set(),
    );
    expect(url.href).toBe('https://example.com/');
  });

  it('should treat a protocol-relative value in "url" as part of the path', () => {
    const url = createRequestUrl(
      createRequest({
        headers: { host: 'localhost:8080' },
        url: '//example.com/test',
      }),
      new Set(),
    );
    expect(url.href).toBe('http://localhost:8080//example.com/test');
  });

  it('should treat a protocol-relative value in "originalUrl" as part of the path', () => {
    const url = createRequestUrl(
      createRequest({
        headers: { host: 'localhost:8080' },
        url: '/test',
        originalUrl: '//example.com/original',
      }),
      new Set(),
    );
    expect(url.href).toBe('http://localhost:8080//example.com/original');
  });

  it('should prioritize "x-forwarded-host" and "x-forwarded-proto" headers', () => {
    const url = createRequestUrl(
      createRequest({
        headers: {
          host: 'localhost:8080',
          'x-forwarded-host': 'example.com',
          'x-forwarded-proto': 'https',
        },
        url: '/test',
      }),
      normalizeTrustProxyHeaders(true),
    );
    expect(url.href).toBe('https://example.com/test');
  });

  it('should use "x-forwarded-port" header for the port', () => {
    const url = createRequestUrl(
      createRequest({
        headers: {
          host: 'localhost:8080',
          'x-forwarded-host': 'example.com',
          'x-forwarded-proto': 'https',
          'x-forwarded-port': '8443',
        },
        url: '/test',
      }),
      normalizeTrustProxyHeaders(true),
    );
    expect(url.href).toBe('https://example.com:8443/test');
  });

  it('should prioritize "forwarded" header over standard and x-forwarded headers', () => {
    const url = createRequestUrl(
      createRequest({
        headers: {
          host: 'localhost:8080',
          'x-forwarded-host': 'other.com',
          'x-forwarded-proto': 'http',
          'forwarded': 'host=example.com;proto=https',
        },
        url: '/test',
      }),
      normalizeTrustProxyHeaders(true),
    );
    expect(url.href).toBe('https://example.com/test');
  });

  it('should parse forwarded parameters correctly (including quoted values)', () => {
    const url = createRequestUrl(
      createRequest({
        headers: {
          host: 'localhost:8080',
          'forwarded': 'host="example.com:8443";proto="https"',
        },
        url: '/test',
      }),
      normalizeTrustProxyHeaders(true),
    );
    expect(url.href).toBe('https://example.com:8443/test');
  });

  it('should not treat parameters inside quoted values as top-level parameters in "forwarded" header', () => {
    const url = createRequestUrl(
      createRequest({
        headers: {
          host: 'localhost:8080',
          'forwarded': 'for="192.0.2.60;host=evil.com";proto=https',
        },
        url: '/test',
      }),
      normalizeTrustProxyHeaders(true),
    );
    expect(url.href).toBe('https://localhost:8080/test');
  });

  it('should ignore "forwarded" header when it is not trusted', () => {
    const url = createRequestUrl(
      createRequest({
        headers: {
          host: 'localhost:8080',
          'forwarded': 'host=example.com;proto=https',
        },
        url: '/test',
      }),
      normalizeTrustProxyHeaders(false),
    );
    expect(url.href).toBe('http://localhost:8080/test');
  });
});