// Should return remoteAddr, not the spoofed headers
        assertEquals("192.168.1.100", rateLimitHelper.getClientIp(request));
    }

    @Test
    public void test_blockIp() {
        rateLimitHelper.blockIp("192.168.1.100", 1000L);
        assertEquals(1, rateLimitHelper.getBlockedIpCount());

        rateLimitHelper.unblockIp("192.168.1.100");