Struct HttpAclMiddleware 

pub struct HttpAclMiddleware { /* private fields */ }

A reqwest middleware that enforces an HttpAcl.

On each request, checks (in order) the scheme, method, host or IP, port, headers, URL path, and finally any custom ValidateFn, returning reqwest_middleware::Error::Middleware on the first denial. This alone only covers the request as originally built: attach Self::dns_resolver to the Client as well, so domains are checked against the ACL as they resolve, and Self::redirect_policy, so redirect targets are checked too. See the crate-level documentation for a full example wiring all three together.

Implementations

impl HttpAclMiddleware

pub fn new(acl: HttpAcl) -> Self

Create a new HTTP ACL middleware from an already-built HttpAcl.

pub fn acl(&self) -> Arc<HttpAcl>

Get the HttpAcl this middleware enforces.

pub fn dns_resolver(&self) -> Arc<HttpAclDnsResolver>

Create a DNS resolver that enforces the ACL, using getaddrinfo to actually resolve hostnames.

Set via Client::builder().dns_resolver(...). Without this, a domain that resolves to a denied or non-global IP (the classic SSRF vector) is never checked, since HttpAclMiddleware only ever sees the request as built, not the address it eventually connects to.

pub fn with_dns_resolver( &self, dns_resolver: Arc<dyn Resolve>, ) -> Arc<HttpAclDnsResolver>

Same as Self::dns_resolver, but delegating actual resolution to a custom Resolve implementation instead of getaddrinfo.

pub fn redirect_policy(&self) -> Policy

Create a redirect::Policy that enforces the ACL on every redirect hop.

Why this is necessary

HttpAclMiddleware only validates the request it is given. By default reqwest follows HTTP redirects internally (up to 10 hops) before control ever returns to the middleware chain, so a server an allowed host redirects to - e.g. a 302 to http://169.254.169.254/ - is never re-checked against the ACL. Set this policy on the Client (in addition to Self::dns_resolver) to close that gap:

let client = reqwest::Client::builder()
    .dns_resolver(middleware.dns_resolver())
    .redirect(middleware.redirect_policy())
    .build()
    .unwrap();

Uses a maximum of 10 redirects, matching reqwest’s own default. Use Self::redirect_policy_with_max to customise this.

Limitations

Only the scheme, host/IP, port, and URL path of each redirect target can be checked this way - reqwest’s redirect policy does not expose the headers or body of the redirected request, so denied headers, denied bodies, and any custom validate_fn are not re-evaluated per hop.

pub fn redirect_policy_with_max(&self, max_redirects: usize) -> Policy

Same as Self::redirect_policy, but with a custom maximum number of redirects.

Trait Implementations

impl Clone for HttpAclMiddleware

fn clone(&self) -> HttpAclMiddleware

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for HttpAclMiddleware

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Middleware for HttpAclMiddleware

fn handle<'life0, 'life1, 'life2, 'async_trait>( &'life0 self, req: Request, extensions: &'life1 mut Extensions, next: Next<'life2>, ) -> Pin<Box<dyn Future<Output = Result<Response, Error>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait, 'life2: 'async_trait,

Invoked with a request before sending it. If you want to continue processing the request, you should explicitly call next.run(req, extensions).