Documentation
¶
Overview ¶
Package clientip reads the client address out of X-Forwarded-For the one way that survives an appending proxy: from the right.
A proxy that appends (nginx $proxy_add_x_forwarded_for, httputil.ReverseProxy, most CDNs) leaves whatever the client sent on the left and writes the address it observed on the right. The leftmost entry is therefore client-supplied, and keying a rate limit or an access log on it lets one client rotate it per request or name a third party. Walking from the right and skipping the operator's own proxy tiers lands on the first hop no trusted proxy vouches past: the address the outermost trusted proxy saw.
core/middleware.RateLimit, framework/ratelimit.ClientIP and battery/log share this walk so the rule has one implementation.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Forwarded ¶
Forwarded walks every X-Forwarded-For line in h as one comma-separated list, from the right, skipping hops in trusted, and returns the first hop that is not trusted. It reports false when the header is absent, when every hop is trusted, or when the walk meets an entry that is not an IP before it finds an untrusted one: a trusted proxy never writes junk, so junk there means the list cannot be read and the caller falls back to the TCP peer.
The caller decides whether the immediate peer may speak for the header at all; Forwarded only reads it.
Types ¶
type Proxies ¶
type Proxies struct {
// contains filtered or unexported fields
}
Proxies is a parsed trusted-proxy list. Bare IPs match exactly; CIDR entries match by containment. The zero value trusts nothing.
func ParseProxies ¶
ParseProxies parses entries as IPs or CIDRs. Entries that are neither are dropped, so a typo trusts nothing rather than everything.
func (Proxies) ContainsAddr ¶
ContainsAddr is Contains for a textual address, with or without a port.
Source Files