Struct TrustedProxies 

pub struct TrustedProxies(/* private fields */);

The proxies whose X-Forwarded-For we believe.

Implementations

impl TrustedProxies

pub fn from_spec(spec: &str) -> Self

Reads a comma-separated list of CIDRs, skipping anything unparseable.

Trusts nothing when the list is empty, so the peer address is always used. Prefer Self::from_env, which refuses both to guess and to tolerate a typo.

pub fn from_env() -> Result<Self, TrustedProxyError>

Reads TRUSTED_PROXIES, which must be set explicitly.

Neither default is safe to assume, which is why there is none. Trusting nothing while actually behind a proxy keys every user on the ingress address, so one attacker exhausts the shared budget and no one can log in. Trusting something while directly exposed lets anyone forge their identity. Set a CIDR list, or the literal none for a directly-exposed deployment.

EVERY entry must parse. Dropping a bad one with a warning would leave a typo in one range silently un-trusting one ingress path, collapsing that path’s users onto a single shared login budget — the failure this variable exists to prevent, reintroduced quietly.

Errors

If the variable is unset, has no entries, or any entry does not parse.

pub fn trusts(&self, addr: IpAddr) -> bool

pub fn client_ip(&self, peer: SocketAddr, forwarded_for: Option<&str>) -> IpAddr

Resolves the client address for peer, given the request’s X-Forwarded-For value.

Walks the hops right-to-left, skipping ones that are themselves trusted, and returns the first address that is not. That entry is the one our own proxy observed; everything to its left was supplied by the client and is worthless. Falls back to the peer whenever the peer is not trusted, the header is absent, or every entry is unusable.

forwarded_for must carry every X-Forwarded-For value the request held, in order — see forwarded_for. Reading only the first would let a client that sends its own header push the proxy’s observed hop into a second line this never looks at.

Addresses are canonicalized, so ::ffff:203.0.113.7 and 203.0.113.7 are one client rather than two budgets.

Trait Implementations

impl Clone for TrustedProxies

fn clone(&self) -> TrustedProxies

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for TrustedProxies

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for TrustedProxies

fn default() -> TrustedProxies

Returns the “default value” for a type.