adalal/solidtime
1
0
Fork 0
mirror of https://github.com/solidtime-io/solidtime.git synced 2026-08-08 00:02:15 +01:00
Code Issues Packages Projects Releases Wiki Activity

add custom error handling for host mismatch; ensure TrustHosts runs

Browse Source 
before TrustProxies
This commit is contained in:
Gregor Vostrak
2026-08-02 18:09:46 +02:00
parent 32f2f1431b
commit 80d98b30a1
4 changed files with 116 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

41
tests/Feature/TrustHostsTest.php
View File

@@ -5,7 +5,10 @@ declare(strict_types=1);
namespace Tests\Feature;
use App\Http\Middleware\TrustHosts;
use Illuminate\Contracts\Debug\ExceptionHandler;
use Illuminate\Http\Request;
use Symfony\Component\HttpFoundation\Exception\SuspiciousOperationException;
use Symfony\Component\HttpFoundation\Response;
use Tests\TestCase;
class TrustHostsTest extends TestCase
@@ -42,7 +45,7 @@ class TrustHostsTest extends TestCase
private function accepts(Request $request): bool
{
$this->middleware()->handle($request, fn (): string => 'passed');
$this->middleware()->handle($request, fn (Request $request): Response => new Response('passed'));
try {
$request->getHost();
@@ -121,4 +124,40 @@ class TrustHostsTest extends TestCase
$this->assertTrue($this->accepts(Request::create('https://0.0.0.0/health-check/up')));
$this->assertTrue($this->accepts(Request::create('http://localhost/health-check/up')));
}
public function test_health_check_endpoint_clears_state_before_other_middleware_reads_the_host(): void
{
// Simulate trusted-host state left by a previous request in an Octane worker.
Request::setTrustedHosts(['^app\.example\.com$']);
$this->get(self::CANONICAL.'/health-check/up', ['Host' => '0.0.0.0'])
->assertSuccessful()
->assertExactJson(['success' => true]);
}
public function test_untrusted_host_renders_a_helpful_error(): void
{
$handler = app(ExceptionHandler::class);
$exception = new SuspiciousOperationException('Untrusted Host "evil.example.com".');
$response = $handler->render(Request::create('https://evil.example.com/login'), $exception);
$this->assertSame(400, $response->getStatusCode());
$this->assertStringContainsString('TRUSTED_HOSTS', (string) $response->getContent());
}
public function test_untrusted_host_returns_json_for_api_clients(): void
{
$handler = app(ExceptionHandler::class);
$exception = new SuspiciousOperationException('Untrusted Host "evil.example.com".');
$request = Request::create('https://evil.example.com/api/v1/users');
$request->headers->set('Accept', 'application/json');
$response = $handler->render($request, $exception);
$this->assertSame(400, $response->getStatusCode());
$this->assertJson((string) $response->getContent());
$this->assertStringContainsString('TRUSTED_HOSTS', (string) $response->getContent());
}
}