Struct ClientIpKeyExtractor 

pub struct ClientIpKeyExtractor { /* private fields */ }

Rate-limiter key extractor. Defaults to the TCP peer IP (non-spoofable), but can be switched to an OPT-IN X-Forwarded-For mode for reverse-proxy deployments where the peer IP is always the proxy (which would otherwise collapse the per-IP limit to global). #169.

SECURITY: XFF mode is only safe behind a trusted proxy — a directly-reachable server trusting XFF lets any client spoof its key and bypass the limiter. It is therefore off unless BAMBOO_RATE_LIMIT_TRUST_XFF is set, and it fails CLOSED to the peer IP whenever the header is absent, unparseable, or shorter than the configured trusted-hop count (so a rogue/short XFF can’t inject a key).

Trait Implementations

impl Clone for ClientIpKeyExtractor

fn clone(&self) -> ClientIpKeyExtractor

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ClientIpKeyExtractor

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl KeyExtractor for ClientIpKeyExtractor

type Key = IpAddr

The type of the key.

type KeyExtractionError = SimpleKeyExtractionError<&'static str>

The type of the error that can occur if key extraction from the request fails.

fn extract( &self, req: &ServiceRequest, ) -> Result<Self::Key, Self::KeyExtractionError>

Extraction method, will return KeyExtractionError response when the extract failed

fn exceed_rate_limit_response( &self, negative: &NotUntil<QuantaInstant>, response: HttpResponseBuilder, ) -> HttpResponse

The content you want to show it when the rate limit is exceeded. You can calculate the time at which a caller can expect the next positive rate-limiting result by using NotUntil. The HttpResponseBuilder allows you to build a fully customized HttpResponse in case of an error.

fn whitelisted_keys(&self) -> Vec<Self::Key>

Returns a list of whitelisted keys. If a key is in this list, it will never be rate-limited.