Documentation
¶
Overview ¶
Package clientip names the client behind an HTTP request, for the limiters that count per client. It is the one place that decides whether a forwarded header may be believed.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Resolve ¶
Resolve returns the key for r's client.
With no trusted networks it is the connection's remote host, port stripped, and no header is read.
With trusted networks, and only for a request whose connection comes from inside one of them, the client is read from X-Forwarded-For. The list is walked from the right, skipping addresses that are themselves trusted, and the first other address is the client: the address the nearest trusted proxy actually saw. Whatever the client wrote further left is never used, so it cannot pick its own key even when the proxy appends to the header rather than replacing it. An entry that is not a bare IP address ends the walk, and a request with no usable list is keyed by the connection address. A valid address is returned in canonical form, so one client is one key however it is written. No other header is read.
Types ¶
This section is empty.
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
Package clientiptest holds the cases every user of internal/clientip is tested against, so the public ratelimit.RemoteIPKey and the login limiters' resolver cannot disagree about what a request's client is.
|
Package clientiptest holds the cases every user of internal/clientip is tested against, so the public ratelimit.RemoteIPKey and the login limiters' resolver cannot disagree about what a request's client is. |