Test Egress Rules Without Leaking Credentials

Egress tests should prove policy without turning credentials into test fixtures. Begin with deterministic hermetic cases, then reserve any live provider call for the smallest final check.

Build a layered test plan

Pure policy tests

Test host normalization, wildcard handling, denied address ranges, token scope, malformed inputs, redirect decisions, and redaction without starting the real proxy or reaching the network.

Hermetic proxy tests

Use local synthetic endpoints and fake credentials. Confirm that an approved destination receives the expected transformed request while denied destinations never receive an injected value.

Live smoke test

Use a dedicated low-privilege credential and one approved provider endpoint. Capture only status, timing, and a redacted decision trail. Do not record full headers, proxy configuration, tokens, nonces, or CA private material.

Negative cases are the release gate

Include:

unknown or expired proxy token;
host not present in the allowlist;
redirect from an allowed host to a denied destination;
DNS result in a denied range;
invalid or missing CA configuration;
stale process metadata; and
audit destination unavailable when the configured policy requires it.

A secure test expects these cases to fail closed.

Safe-test checklist

Synthetic credentials are used in unit and hermetic tests.
Real credentials never appear in command arguments or fixtures.
Logs are scanned for token and header values.
Redirect and DNS rebinding-style cases are represented.
The live credential is dedicated and least-privilege.
Live output records evidence without raw request headers.
Temporary files and processes are cleaned up.
Failure behavior is verified, not merely observed.

Common pitfalls

Using production credentials for convenience

A test suite is copied, cached, and shared more widely than an operator shell. Keep real provider keys out of it.

Publishing “sanitized” logs without checking

Tokens can appear in URLs, headers, subprocess arguments, tracebacks, or generated configuration. Scan the actual artifact before sharing.

Treating one blocked hostname as complete coverage

Destination policy also interacts with normalization, redirects, DNS results, transport, and runtime configuration.

Verification steps

Run pure policy tests with no network access.
Run hermetic proxy tests with fake credentials.
Search all produced logs and artifacts for the fake secret marker; only the intended synthetic receiver may contain it.
Confirm every negative case fails closed.
Run one bounded live smoke test if required.
Revoke or rotate the dedicated live credential after the test window when appropriate.

Official reference

Use the current Egress proxy internals page for the supported test layers and implementation boundaries.