Spoofing req.ip for testing

[onosendi]

Any way to set req.ip for testing? I tried something like:

fastify.addHook('onRequest', async (req) => {
    req.ip = '01.02.03.04';
});

Plugin looks like:

async function internalIpOnly(fastify) {
    fastify.addHook('onRequest', async (req, reply) => {
        const { ip } = req;

        if (
            process.env.NODE_ENV === 'production'
            && !ip.startsWith('01.02.03')
        ) {
            reply.status(StatusCodes.FORBIDDEN);

            throw new Error(`IP address is not internal: ${ip}`);
        }
    });
}

[mcollina]

Looks great!

[onosendi]

Matteo! It was a question :P

Setting req.ip like this doesn't seem to work.

it('Returns 200 if in production and IP is internal', async () => {
    const fastify = Fastify();

    fastify.get('/test', () => 'Ok');

    fastify.register(internal_ip_only);

    fastify.addHook('onRequest', async (req) => {
        req.ip = '01.02.03.04';
    });

    process.env.NODE_ENV = 'production';

    const response = await fastify.inject({
        url: '/test',
        method: 'get',
    });

    process.env.NODE_ENV = 'development';

    expect(response.statusCode).toBe(StatusCodes.OK);
});

[Uzlopak]

The order is wrong imho. First register you ip spoofer than register internal_ip_only

[onosendi]

@Uzlopak Ah, I did get a different outcome with your suggestion, however now it's:

{"statusCode":500,"error":"Internal Server Error","message":"Cannot set property ip of #<Request> which has only a getter"}

[Uzlopak]

I would just move the process.env.NODE_ENV === 'production out

async function internalIpOnly(fastify) {
    if (process.env.NODE_ENV === 'production') {
    fastify.addHook('onRequest', async (req, reply) => {
        const { ip } = req;
        if (
             !ip.startsWith('01.02.03')
        ) {
            reply.status(StatusCodes.FORBIDDEN);

            throw new Error(`IP address is not internal: ${ip}`);
        }
    });
    }
}

[onosendi]

Ah, yes, I like that better. Thank you.

[onosendi]

This seemed to do the trick.

Update

The better solution would be to use light-my-request's remoteAddress option:

const res = await fastify.inject({
  method: 'get',
  url: '/foo',
  remoteAddress: '01.02.03.04',
});

Old answer

fastify.addHook('onRequest', async (req) => {
    Object.defineProperty(req, 'ip', {
        value: '01.02.03.04',
    });
});