mirror of
https://github.com/wassname/flask-security.git
synced 2026-06-27 16:10:11 +08:00
Stephen J. Fuhry
923ad720a1
From the nginx docs: http://nginx.org/en/docs/http/ngx_http_proxy_module.html > $proxy_add_x_forwarded_for > the “X-Forwarded-For” client request header field with the $remote_addr > variable appended to it, separated by a comma. If the “X-Forwarded-For” > field is not present in the client request header, the > $proxy_add_x_forwarded_for variable is equal to the $remote_addr > variable. Use the last IP address in X-Forwarded-For. For this to work properly behind a trusted proxy, you must be using ProxyFix as described in the flask & werkzeug documentation.
45 lines
1.2 KiB
Python
45 lines
1.2 KiB
Python
# -*- coding: utf-8 -*-
|
|
"""
|
|
test_trackable
|
|
~~~~~~~~~~~~~~
|
|
|
|
Trackable tests
|
|
"""
|
|
|
|
import pytest
|
|
|
|
from utils import authenticate, logout
|
|
|
|
pytestmark = pytest.mark.trackable()
|
|
|
|
|
|
def test_trackable_flag(app, client):
|
|
e = 'matt@lp.com'
|
|
authenticate(client, email=e)
|
|
logout(client)
|
|
authenticate(client, email=e, headers={'X-Forwarded-For': '127.0.0.1'})
|
|
|
|
with app.app_context():
|
|
user = app.security.datastore.find_user(email=e)
|
|
assert user.last_login_at is not None
|
|
assert user.current_login_at is not None
|
|
assert user.last_login_ip == 'untrackable'
|
|
assert user.current_login_ip == '127.0.0.1'
|
|
assert user.login_count == 2
|
|
|
|
|
|
def test_trackable_with_multiple_ips_in_headers(app, client):
|
|
e = 'matt@lp.com'
|
|
authenticate(client, email=e)
|
|
logout(client)
|
|
authenticate(client, email=e, headers={
|
|
'X-Forwarded-For': '99.99.99.99, 88.88.88.88'})
|
|
|
|
with app.app_context():
|
|
user = app.security.datastore.find_user(email=e)
|
|
assert user.last_login_at is not None
|
|
assert user.current_login_at is not None
|
|
assert user.last_login_ip == 'untrackable'
|
|
assert user.current_login_ip == '88.88.88.88'
|
|
assert user.login_count == 2
|