feat: 准备 Admin 线上 HTTPS 部署 (#81)

admin/handler/web/auth_test.go

@@ -40,12 +40,16 @@ func TestPasswordReturnPath移除改密反馈参数(t *testing.T) {
 func TestAuthCookie安全属性(t *testing.T) {
 	gin.SetMode(gin.TestMode)
 	for _, test := range []struct {
-		name   string
-		tls    bool
-		secure bool
+		name          string
+		tls           bool
+		remoteAddress string
+		forwarded     string
+		secure        bool
 	}{
-		{"HTTP", false, false},
-		{"HTTPS", true, true},
+		{name: "HTTP", secure: false},
+		{name: "HTTPS", tls: true, secure: true},
+		{name: "本机HTTPS反向代理", remoteAddress: "127.0.0.1:12345", forwarded: "https", secure: true},
+		{name: "外部来源不能伪造代理头", remoteAddress: "203.0.113.8:12345", forwarded: "https", secure: false},
 	} {
 		t.Run(test.name, func(t *testing.T) {
 			response := httptest.NewRecorder()
@@ -53,6 +57,12 @@ func TestAuthCookie安全属性(t *testing.T) {
 			if test.tls {
 				request.TLS = &tls.ConnectionState{}
 			}
+			if test.remoteAddress != "" {
+				request.RemoteAddr = test.remoteAddress
+			}
+			if test.forwarded != "" {
+				request.Header.Set("X-Forwarded-Proto", test.forwarded)
+			}
 			context, _ := gin.CreateTestContext(response)
 			context.Request = request
 			setAuthCookie(context, "raw-token", time.Now().Add(12*time.Hour))