Struct ProxyConfig 

pub struct ProxyConfig {
    pub trusted_proxies: Vec<IpAddr>,
    pub require_trusted_proxy: bool,
}

Proxy configuration for X-Forwarded-For header validation

Fields

trusted_proxies: Vec<IpAddr>

List of trusted proxy IPs (e.g., load balancer, Nginx, HAProxy IPs) Only X-Forwarded-For headers from these IPs are trusted

require_trusted_proxy: bool

If true, require request to come from a trusted proxy to use X-Forwarded-For

Implementations

impl ProxyConfig

pub const fn new( trusted_proxies: Vec<IpAddr>, require_trusted_proxy: bool, ) -> Self

Create a new proxy configuration

pub fn localhost_only() -> Self

Create a proxy config that trusts all local proxies (127.0.0.1 only).

Panics

Cannot panic — the IP literal "127.0.0.1" is always valid.

pub const fn none() -> Self

Create a proxy config with no trusted proxies

pub fn is_trusted_proxy(&self, ip: &str) -> bool

Check if an IP address is a trusted proxy

SECURITY

Validates IP format before checking against trusted list. Returns false for any invalid IP format, preventing bypass attempts.

pub fn extract_client_ip( &self, headers: &HeaderMap, socket_addr: Option<SocketAddr>, ) -> Option<String>

Extract client IP from headers with security validation

SECURITY

Only trusts X-Forwarded-For if the request comes from a trusted proxy. Falls back to direct connection IP if X-Forwarded-For cannot be validated. Validates all extracted IPs to ensure proper format.

This prevents IP spoofing attacks where an attacker sends a malicious X-Forwarded-For header to bypass rate limiting or access controls.

Trait Implementations

impl Clone for ProxyConfig

fn clone(&self) -> ProxyConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ProxyConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.