Do not be case-sensitive when checking http headers

Issue: ARSN-453
scality · Dec 23, 2024 · 89a7f0e · 89a7f0e
1 parent 6ec3c8e
commit 89a7f0e
Show file tree

Hide file tree

Showing 2 changed files with 25 additions and 1 deletion.
diff --git a/lib/policyEvaluator/requestUtils.ts b/lib/policyEvaluator/requestUtils.ts
@@ -30,7 +30,10 @@ export function getClientIp(request: IncomingMessage, s3config?: S3Config): stri
          * which header to be used to extract client IP
          */
         if (ipCheck.ipMatchCidrList(trustedProxyCIDRs, clientIp)) {
-            const ipFromHeader = request.headers[extractClientIPFromHeader]?.toString();
+            // Request headers in nodejs are lower-cased, so we should not
+            // be case-sentive when looking for the header, as http headers
+            // are case-insensitive.
+            const ipFromHeader = request.headers[extractClientIPFromHeader.toLowerCase()]?.toString();
             if (ipFromHeader && ipFromHeader.trim().length) {
                 return ipFromHeader.split(',')[0].trim();
             }

diff --git a/tests/unit/policyEvaluator/requestUtils.spec.js b/tests/unit/policyEvaluator/requestUtils.spec.js
@@ -27,6 +27,27 @@ describe('requestUtils.getClientIp', () => {
         assert.strictEqual(result, testClientIp1);
     });
 
+    it('should return client Ip address in the proxy case when the header has uppercases', () => {
+        const request = new DummyRequest({
+            headers: {
+                'x-forwarded-for': [testClientIp1, testProxyIp].join(','),
+            },
+            url: '/',
+            parsedHost: 'localhost',
+            socket: {
+                remoteAddress: testProxyIp,
+            },
+        });
+        const result = requestUtils.getClientIp(request, {
+            requests: {
+                viaProxy: true,
+                trustedProxyCIDRs: ['192.168.100.0/22'],
+                extractClientIPFromHeader: 'X-Forwarded-For',
+            },
+        });
+        assert.strictEqual(result, testClientIp1);
+    });
+
     it('should return client Ip address from socket info if the request is not forwarded from proxies', () => {
         const request = new DummyRequest({
             headers: {},