Struct ReverseProxyAuthenticator 

pub struct ReverseProxyAuthenticator { /* private fields */ }

Authenticator that reads the caller’s identity from a header set by a trusted upstream reverse proxy (e.g. nginx / Envoy / an OAuth2 proxy that forwards X-Forwarded-User).

The proxy is responsible for actually authenticating the request; this authenticator only trusts and extracts the forwarded identity, so it must only be enabled when the server is not directly reachable — otherwise a client could forge the header. It exists so that features which vend credentials on the caller’s behalf (notably the same-origin storage byte-proxy) attribute access to a real user instead of the over-privileged Principal::anonymous.

When the header is absent, on_missing decides whether to reject the request (401) or fall back to anonymous.

Implementations

impl ReverseProxyAuthenticator

pub fn new() -> Self

Build an authenticator reading DEFAULT_FORWARDED_USER_HEADER, rejecting requests that lack it.

pub fn with_header(self, header: impl Into<String>) -> Self

Override the header the identity is read from.

pub fn with_on_missing(self, on_missing: OnMissingIdentity) -> Self

Set the behavior when the header is absent (default: OnMissingIdentity::Reject).

Trait Implementations

impl Authenticator<Principal> for ReverseProxyAuthenticator

fn authenticate(&self, request: &Request) -> Result<Principal>

Authenticate a request and return an identity value.

impl Clone for ReverseProxyAuthenticator

fn clone(&self) -> ReverseProxyAuthenticator

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Default for ReverseProxyAuthenticator

fn default() -> Self

Returns the “default value” for a type.