Add Handshake::forwarded_addr() to get a trusted forwarded address #295
Conversation
The X-Forwarded-For header is implicitly untrustworthy, this adds `Handshake::forwarded_addr()` and `Request::forwarded_addr()` to get a trusted address at exactly specified proxy depth.
| #[allow(dead_code)] | ||
| fn forwarded_addr(&self, trusted: usize) -> Result<Option<String>> { |
There was a problem hiding this comment.
This function would be helpful, if it was accessible.
Github stops me from suggesting, so I just write it out.
The #[allow(dead_code)] is not nessesary when the function gets a pub
There was a problem hiding this comment.
This is modelled exactly along the existing functions and API. I'd rather have this merged with no fuss than propose an new API.
| /// This method will attempt to retrieve a specific forwarded IP address of the requester | ||
| /// in the following manner: | ||
| /// | ||
| /// If the `X-Forwarded-For` header exists, this method will return the `trusted` right most |
There was a problem hiding this comment.
Should not it say "left most address", or I am understanding it wrong ?
There was a problem hiding this comment.
The n'th (with n=trusted) address from the right end. Usually an address farther to the left (front) can't be trusted -- it's an arbitrary value from a proxy /client farther away from the server. E.g. if I only trust my own proxy, I want the last (right most) entry.
If a request goes through multiple proxies, the IP addresses of each successive proxy is listed. This means, the right-most IP address is the IP address of the most recent proxy and the left-most IP address is the IP address of the originating client.
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-For#Directives
There was a problem hiding this comment.
Huge thanks for the explanation. Also, I must be blind, cos I did not notice rsplit instead of split. So, apologies, my bad.
The X-Forwarded-For header is implicitly untrustworthy, the need may arise to get the last trusted address in a reverse proxy chain.
This adds
Handshake::forwarded_addr(trusted)andRequest::forwarded_addr(trusted)to get a address at exactly specified
trustedproxy depth.E.g. in the common example of a service behind a Apache or Nginx reverse proxy use
forwarded_addr(1)to get the rightmost X-Forwarded-For header address.Using
forwarded_addr(0)will always return the direct peer address.I'm currently using this as extension trait and it's confirmed to work well.