alphagov/cdn-acceptance-tests — pull request #16 by dcarley (2014-06-10 14:12:22+00:00)
Title: Implement TestHeaderUnspoofableClientIP() test

Send a request with a `True-Client-IP` header set to an RFC5737 address and
check that origin receives a request with the header set to a different and
valid IP address (which could be IPv6).

It's important to note that this doesn't check that it's actually *our* IP
address because:

- For the real CDN we'd have to call out to a third-party service e.g.
`canhazip.com` to get our external IP.
- For the mock CDN it would be the IP on the private network rather than the
external IP.

I was concerned that there might be a race condition whereby
`receivedHeaderVal` didn't get set at the point we checked the value. Which
could probably be guarded against by using a channel or reflecting the value
in the response.

However after testing this, by adding some delays to Varnish, I can't
reproduce it. I'm guessing this is because `client.RoundTrip()` blocks until
we get the response (by which time originServer.handler has been called).