Struct TrustedProxyIpKeyExtractor 

pub struct TrustedProxyIpKeyExtractor { /* private fields */ }

Rate limit by client IP with trusted proxy validation.

This is a secure IP extractor that only trusts X-Forwarded-For headers when the immediate upstream (TCP peer) is a known trusted proxy.

How It Works

1. If RemoteAddr extension is set and matches a trusted proxy CIDR:
   • Extract client IP from X-Forwarded-For (first IP in chain)
2. If RemoteAddr is set but NOT a trusted proxy:
   • Use the RemoteAddr directly (the client connected directly)
3. If RemoteAddr is not set:
   • Returns None (request is not rate-limited) - safer than guessing

Example

use fastapi_core::middleware::{TrustedProxyIpKeyExtractor, RateLimitMiddleware};

let extractor = TrustedProxyIpKeyExtractor::new()
    .trust_cidr("10.0.0.0/8")      // Internal network
    .trust_cidr("172.16.0.0/12")   // Docker default
    .trust_loopback();              // localhost

let rate_limiter = RateLimitMiddleware::builder()
    .requests(100)
    .per(Duration::from_secs(60))
    .key_extractor(extractor)
    .build();

Implementations

impl TrustedProxyIpKeyExtractor

pub fn new() -> Self

Create a new trusted proxy IP extractor with no trusted proxies.

pub fn trust_cidr(self, cidr: &str) -> Self

Add a trusted CIDR range (e.g., “10.0.0.0/8”, “192.168.1.0/24”).

Panics

Panics if the CIDR string is invalid.

pub fn trust_loopback(self) -> Self

Trust loopback addresses (127.0.0.0/8 for IPv4, ::1/128 for IPv6).

Trait Implementations

impl Clone for TrustedProxyIpKeyExtractor

fn clone(&self) -> TrustedProxyIpKeyExtractor

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for TrustedProxyIpKeyExtractor

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for TrustedProxyIpKeyExtractor

fn default() -> Self

Returns the “default value” for a type.

impl KeyExtractor for TrustedProxyIpKeyExtractor

fn extract_key(&self, req: &Request) -> Option<String>

Extract the key string from the request.