httputil

func ClientIP ¶

func ClientIP(r *http.Request, trusted []*net.IPNet) net.IP

ClientIP returns the source IP for rate-limiting and audit logging.

X-Forwarded-For is honored only when the immediate peer (r.RemoteAddr) matches an entry in the trusted list. The XFF walk runs right-to-left through trusted hops and returns the first untrusted IP — the real client. Attackers can prepend arbitrary values to XFF but cannot append past trusted hops, so prepended values are unreachable.

With an empty trust list, XFF is ignored entirely. Returns nil only if r.RemoteAddr is unparseable.

func IsHTTPS ¶

func IsHTTPS(r *http.Request, trusted []*net.IPNet) bool

IsHTTPS reports whether the request actually arrived over TLS — either natively (r.TLS != nil) or via a TLS-terminating peer in the trusted list that set X-Forwarded-Proto: https. With an empty trust list, X-Forwarded-Proto is ignored entirely.

func ParseTrustedProxies ¶

func ParseTrustedProxies(csv string) ([]*net.IPNet, error)

ParseTrustedProxies parses a comma-separated CIDR list into IP networks. Empty input returns an empty slice and nil error. Any invalid CIDR aborts the parse and the offending value appears in the returned error.