Module client_addr 

Client-address resolution that does not blindly trust hop headers.

resolve_client_ip is the single helper every middleware that cares about the originating client (rate-limiter, IP banlist, bot-scoring, abuse heuristics) must use. The contract:

1. If the immediate socket peer (ConnectInfo<SocketAddr>) is not contained in trusted_proxies, return the peer address. Hop headers are ignored entirely — they are untrusted in this case.
2. If the peer is trusted, walk X-Forwarded-For right-to-left and take the first hop that is itself outside trusted_proxies. That hop is the closest entity our proxy chain still sees, and the earliest one a client could have spoofed.
3. If the chain is empty or every hop is trusted, fall back to the peer address.

X-Real-IP, Fly-Client-IP, and CF-Connecting-IP are honoured only under rule 2’s trust gate; otherwise they are ignored.

The trusted-proxy CIDR set is parsed and validated when the profile loads (ServerConfig::trusted_proxies deserialises to Vec<IpNet>); an invalid entry fails boot rather than being silently dropped, so this resolver only ever sees a validated set.

Copyright (c) systemprompt.io — Business Source License 1.1. See https://systemprompt.io for licensing details.

Structs

ClientIp

Functions

client_ip_from_request

forwarded_headers_ignored

resolve_client_ip

resolve_client_ip_from_config