api-platform / core

The server component of API Platform: hypermedia and GraphQL APIs in minutes
https://api-platform.com
MIT License
2.4k stars 856 forks source link

Impossible to set REMOTE_ADDR for functional test #4352

Closed stefantalen closed 2 years ago

stefantalen commented 3 years ago

API Platform version(s) affected: All

Description When using ips for access_control, there is no way to set an IP for tests. The header is being converted to HTTP_REMOTE_ADDR instead of REMOTE_ADDR.

How to reproduce
Having this requirement in security.yaml

parameters:
    env(TRUSTED_IPS): '10.10.10.10'

access_control:
    # Allow access based on IP
    - { path: ^/api/ip-restricted-endpoint, roles: IS_AUTHENTICATED_ANONYMOUSLY, ips: '%env(TRUSTED_IPS)%' }
    # Require authentication for everything else
    - { path: ^/, roles: IS_AUTHENTICATED_FULLY }

Example testcase

public function testUnauthorizedIsPageSuccessful() {
    self::createClient()->request('GET', '/api/ip-restricted-endpoint');
    $this->assertResponseStatusCodeSame(401);
    self::createClient()->request('GET', '/api/ip-restricted-endpoint', ['headers' => ['remote-addr' => '10.10.10.10']]);
    $this->assertResponseIsSuccessful();
}

Possible Solution
A similar solution as the content-type header could be used in ApiPlatform\Core\Bridge\Symfony\Bundle\Test\Client::request

if ('remote-addr' === $key) {
    $server['REMOTE_ADDR'] = $value[0] ?? '';
    continue;
}
alanpoulain commented 2 years ago

Will be solved in 2.6.6 and/or 2.7.