File

mod_http: Use RFC 7239 Forwarded header to find original client IP Prefer over X-Forwarded-* since it has an actual specification. Main practical difference is that Forwarded may carry more properties than only the IP address since it is a structured header. Since we parse it into an array, it is easier to do the logical thing and iterate backwards trough proxies until an untrusted one is encountered. Compare the handling of X-Forwarded-For. The 'secure' field now accounts for the full chain of proxies, which must be secure all the way to be considered secure.

local random = require "util.random";

describe("util.random", function()
	describe("#bytes()", function()
		it("should return a string", function()
			assert.is_string(random.bytes(16));
		end);

		it("should return the requested number of bytes", function()
			-- Makes no attempt at testing how random the bytes are,
			-- just that it returns the number of bytes requested

			for i = 1, 20 do
				assert.are.equal(2^i, #random.bytes(2^i));
			end
		end);
	end);
end);