Enum KeyExtractor 

pub enum KeyExtractor {
    ForwardedIp,
    PeerIp,
    UserId,
    TenantId,
    LoginIdentifier,
    Header(String),
}

What to use as the rate-limit bucket key.

Variants

ForwardedIp

Rate limit by client IP from a trusted reverse proxy header.

Reads X-Real-IP then X-Forwarded-For (first entry). Use this only when deployed behind a reverse proxy (NGINX, Envoy, ALB, Cloudflare) that sets these headers from the real peer address and strips client-supplied values.

Without a trusted proxy, clients can spoof these headers to bypass rate limiting entirely. For direct-to-client deployments, use PeerIp instead.

PeerIp

Rate limit by TCP peer address via axum’s ConnectInfo.

Requires Router::into_make_service_with_connect_info::<SocketAddr>() on your axum server. Falls back to a shared bucket ("unknown") if ConnectInfo is not available; this is fail-closed (all requests share one bucket = stricter limiting).

UserId

Rate limit by authenticated user (reads x-user-id header or request extension).

TenantId

Rate limit by tenant (reads x-tenant-id header or request extension).

LoginIdentifier

Rate limit by the login identifier (username/email submitted to a login route). Reads the RateLimitLoginIdentifier request extension that the application sets after parsing the login form.

Why it exists

PeerIp rate-limits the source. LoginIdentifier rate-limits the target. Without this layer, an attacker rotating IPs (or simply using a botnet) can issue 5 wrong-password POSTs per known username and lock the legitimate user out of their account: a per-account denial-of-service that needs no compromised credentials.

Always pair this with PeerIp on login routes; see the module-level example.

Falls back to a shared anonymous-bucket sentinel when no extension is present, so a misconfigured route fails closed (one shared bucket) rather than evading the limit.

Header(String)

Rate limit by an arbitrary header value.

Trait Implementations

impl Clone for KeyExtractor

fn clone(&self) -> KeyExtractor

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for KeyExtractor

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.