server/tests/api/server/reverse-proxy.ts

   1 /* eslint-disable @typescript-eslint/no-unused-expressions,@typescript-eslint/require-await */
   2
   3 import { expect } from 'chai'
   4 import { HttpStatusCode } from '@shared/core-utils'
   5 import {
   6   cleanupTests,
   7   flushAndRunServer,
   8   getVideo,
   9   registerUser,
  10   setAccessTokensToServers,
  11   uploadVideo,
  12   viewVideo,
  13   wait
  14 } from '@shared/extra-utils'
  15
  16 describe('Test application behind a reverse proxy', function () {
  17   let server = null
  18   let videoId
  19
  20   before(async function () {
  21     this.timeout(30000)
  22
  23     const config = {
  24       rates_limit: {
  25         api: {
  26           max: 50,
  27           window: 5000
  28         },
  29         signup: {
  30           max: 3,
  31           window: 5000
  32         },
  33         login: {
  34           max: 20
  35         }
  36       },
  37       signup: {
  38         limit: 20
  39       }
  40     }
  41
  42     server = await flushAndRunServer(1, config)
  43     await setAccessTokensToServers([ server ])
  44
  45     const { body } = await uploadVideo(server.url, server.accessToken, {})
  46     videoId = body.video.uuid
  47   })
  48
  49   it('Should view a video only once with the same IP by default', async function () {
  50     this.timeout(20000)
  51
  52     await viewVideo(server.url, videoId)
  53     await viewVideo(server.url, videoId)
  54
  55     // Wait the repeatable job
  56     await wait(8000)
  57
  58     const { body } = await getVideo(server.url, videoId)
  59     expect(body.views).to.equal(1)
  60   })
  61
  62   it('Should view a video 2 times with the X-Forwarded-For header set', async function () {
  63     this.timeout(20000)
  64
  65     await viewVideo(server.url, videoId, HttpStatusCode.NO_CONTENT_204, '0.0.0.1,127.0.0.1')
  66     await viewVideo(server.url, videoId, HttpStatusCode.NO_CONTENT_204, '0.0.0.2,127.0.0.1')
  67
  68     // Wait the repeatable job
  69     await wait(8000)
  70
  71     const { body } = await getVideo(server.url, videoId)
  72     expect(body.views).to.equal(3)
  73   })
  74
  75   it('Should view a video only once with the same client IP in the X-Forwarded-For header', async function () {
  76     this.timeout(20000)
  77
  78     await viewVideo(server.url, videoId, HttpStatusCode.NO_CONTENT_204, '0.0.0.4,0.0.0.3,::ffff:127.0.0.1')
  79     await viewVideo(server.url, videoId, HttpStatusCode.NO_CONTENT_204, '0.0.0.5,0.0.0.3,127.0.0.1')
  80
  81     // Wait the repeatable job
  82     await wait(8000)
  83
  84     const { body } = await getVideo(server.url, videoId)
  85     expect(body.views).to.equal(4)
  86   })
  87
  88   it('Should view a video two times with a different client IP in the X-Forwarded-For header', async function () {
  89     this.timeout(20000)
  90
  91     await viewVideo(server.url, videoId, HttpStatusCode.NO_CONTENT_204, '0.0.0.8,0.0.0.6,127.0.0.1')
  92     await viewVideo(server.url, videoId, HttpStatusCode.NO_CONTENT_204, '0.0.0.8,0.0.0.7,127.0.0.1')
  93
  94     // Wait the repeatable job
  95     await wait(8000)
  96
  97     const { body } = await getVideo(server.url, videoId)
  98     expect(body.views).to.equal(6)
  99   })
 100
 101   it('Should rate limit logins', async function () {
 102     const user = { username: 'root', password: 'fail' }
 103
 104     for (let i = 0; i < 19; i++) {
 105       await server.loginCommand.getAccessToken(user, HttpStatusCode.BAD_REQUEST_400)
 106     }
 107
 108     await server.loginCommand.getAccessToken(user, HttpStatusCode.TOO_MANY_REQUESTS_429)
 109   })
 110
 111   it('Should rate limit signup', async function () {
 112     for (let i = 0; i < 10; i++) {
 113       try {
 114         await registerUser(server.url, 'test' + i, 'password')
 115       } catch {
 116         // empty
 117       }
 118     }
 119
 120     await registerUser(server.url, 'test42', 'password', HttpStatusCode.TOO_MANY_REQUESTS_429)
 121   })
 122
 123   it('Should not rate limit failed signup', async function () {
 124     this.timeout(30000)
 125
 126     await wait(7000)
 127
 128     for (let i = 0; i < 3; i++) {
 129       await registerUser(server.url, 'test' + i, 'password', HttpStatusCode.CONFLICT_409)
 130     }
 131
 132     await registerUser(server.url, 'test43', 'password', HttpStatusCode.NO_CONTENT_204)
 133
 134   })
 135
 136   it('Should rate limit API calls', async function () {
 137     this.timeout(30000)
 138
 139     await wait(7000)
 140
 141     for (let i = 0; i < 100; i++) {
 142       try {
 143         await getVideo(server.url, videoId)
 144       } catch {
 145         // don't care if it fails
 146       }
 147     }
 148
 149     await getVideo(server.url, videoId, HttpStatusCode.TOO_MANY_REQUESTS_429)
 150   })
 151
 152   after(async function () {
 153     await cleanupTests([ server ])
 154   })
 155 })