Affected by 
Documentation
¶
Overview ¶
Package clientip resolves the client address of a request from the connection peer and, only when that peer is a trusted proxy, from the forwarding headers it set. Every rate limit and session record keys on the value this package produces, so a client can never choose its own address by sending a header.
Index ¶
Constants ¶
const KeywordNone = "none"
KeywordNone trusts no proxy at all: the peer address is always the client.
const KeywordPrivate = "private"
KeywordPrivate expands to the loopback, RFC 1918, link-local, and unique-local ranges, which covers a reverse proxy on the same host or on a container network. It is the default because that is how most instances are deployed, and a default of "none" would put every user behind such a proxy into one shared bucket. The trade is that any peer on the private network is believed when it forwards an address; an operator whose instance is reached directly through a NAT hop that presents a private peer address without rewriting headers should set "none" or list the real proxy explicitly.
Variables ¶
This section is empty.
Functions ¶
func FromContext ¶
FromContext returns the client address stored by the middleware, or "" when the request did not pass through it.
func Middleware ¶
func Middleware(resolver *Resolver) echo.MiddlewareFunc
Middleware resolves the client address once per request and stores it in the request context, where both API transports and the file server read it.
Types ¶
type Resolver ¶
type Resolver struct {
// contains filtered or unexported fields
}
Resolver decides which address identifies the client of a request.
func ParseTrustedProxies ¶
ParseTrustedProxies turns the configured list into a resolver. Each entry is a CIDR, a single address, or one of the keywords. An empty list means "private". Entries may themselves be comma-separated.
Source Files