Cleanuparr/e2e/nginx/nginx.conf

events {}

http {
    server {
        listen 8000;

        # Production-realistic proxy: appends the real client IP to XFF.
        location / {
            proxy_pass http://localhost:5000;
            proxy_set_header Host $host;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header X-Forwarded-Host $host;
        }

        # Attacker-simulation proxy: appends a hardcoded public IP (99.99.99.99)
        # so the regression test can simulate the GHSA-8q44-v65j-jc3q scenario
        # from a localhost test runner.
        location /attacker/ {
            rewrite ^/attacker/(.*)$ /$1 break;
            proxy_pass http://localhost:5000;
            proxy_set_header Host $host;
            proxy_set_header X-Forwarded-For "$http_x_forwarded_for, 99.99.99.99";
            proxy_set_header X-Forwarded-Proto $scheme;
            proxy_set_header X-Forwarded-Host $host;
        }
    }
}