Skip to main content

extract_client_ip

cloudillo_core::rate_limit

Function extract_client_ip 

Source 
pub fn extract_client_ip<B>(
    req: &Request<B>,
    mode: &ServerMode,
) -> Option<IpAddr>
Expand description

Extract client IP from request based on ServerMode

  • Standalone mode: Use peer IP directly from ConnectInfo
  • Proxy/StreamProxy mode: Check forwarding headers first

§Security: forwarding-header trust model

Client-supplied forwarding headers (X-Forwarded-For, X-Real-IP, Forwarded) are only trusted in ServerMode::Proxy / ServerMode::StreamProxy. In the default ServerMode::Standalone deployment (direct-to-internet, see server/src/main.rs), they are ignored entirely and the kernel-reported peer IP is used, so a client cannot spoof its address to evade IP-based rate limiting or bans.

The Proxy modes trust these headers because the IP is taken from them. They are therefore only safe behind a trusted reverse proxy that strips any client-supplied forwarding headers and sets its own — otherwise a client could forge an arbitrary client IP. Do not enable a Proxy mode while exposed directly to the internet.