Merge commit from fork

Signed-off-by: Jan Larwig <jan@larwig.com>

pkg/apis/middleware/scope_test.go

@@ -4,6 +4,7 @@ import (
 	"net/http"
 
 	"github.com/oauth2-proxy/oauth2-proxy/v7/pkg/apis/middleware"
+	"github.com/oauth2-proxy/oauth2-proxy/v7/pkg/ip"
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 )
@@ -53,4 +54,37 @@ var _ = Describe("Scope Suite", func() {
 			})
 		})
 	})
+
+	Context("CanTrustForwardedHeaders", func() {
+		var request *http.Request
+		var scope *middleware.RequestScope
+
+		BeforeEach(func() {
+			var err error
+			request, err = http.NewRequest("", "http://127.0.0.1/", nil)
+			Expect(err).ToNot(HaveOccurred())
+
+			trustedProxies, err := ip.ParseNetSet([]string{"127.0.0.1"})
+			Expect(err).ToNot(HaveOccurred())
+			scope = &middleware.RequestScope{
+				ReverseProxy:   true,
+				TrustedProxies: trustedProxies,
+			}
+		})
+
+		It("returns true for a trusted remote address", func() {
+			request.RemoteAddr = "127.0.0.1:4180"
+			Expect(scope.CanTrustForwardedHeaders(request)).To(BeTrue())
+		})
+
+		It("returns false for an untrusted remote address", func() {
+			request.RemoteAddr = "192.0.2.10:4180"
+			Expect(scope.CanTrustForwardedHeaders(request)).To(BeFalse())
+		})
+
+		It("returns true for unix socket callers", func() {
+			request.RemoteAddr = "@"
+			Expect(scope.CanTrustForwardedHeaders(request)).To(BeTrue())
+		})
+	})
 })