Archived
13 lines
482 B
Python
13 lines
482 B
Python
"""Untrusted clients cannot replace the configured mount prefix."""
|
|
|
|
from fastapi.testclient import TestClient
|
|
|
|
|
|
def test_direct_client_cannot_forge_prefix(prefixed_client: TestClient) -> None:
|
|
response = prefixed_client.get("/evil/health", headers={
|
|
"X-Forwarded-Prefix": "/evil", "X-Forwarded-Host": "attacker.example",
|
|
"X-Forwarded-Proto": "https",
|
|
})
|
|
assert response.status_code == 404
|
|
assert response.json()["error"]["code"] == "path_not_found"
|