search

imbolc / axum-client-ip

A client IP address extractor for Axum
MIT License
41 stars 13 forks source link

`LeftmostXForwardedFor` for extracting client IP for requests proxied through Cloudflare #24

Closed 64bit closed 9 months ago

64bit commented 10 months ago

Hello,

Just like RightmostXForwardedFor having equivalent LeftmostXForwardedFor will help extract Client IP from X-Forwarded-For header when request gets proxied through Cloudflare. Specially in situations where CF-Connecting-IP header is not available for requests going though other load balancers.

More about why leftmost is in the doc below:

https://developers.cloudflare.com/fundamentals/reference/http-request-headers/#x-forwarded-for

Thank you

imbolc commented 10 months ago

If there are proxies in the chain that we don't control, and we know CloudFlare adds its IP to the right, the trustworthy IP would still be the second one from the right, not the leftmost one: https://adam-p.ca/blog/2022/03/x-forwarded-for/#trying-to-learn-about-x-forwarded-for

64bit commented 9 months ago

Thanks for sharing the link and your response, it does make sense from security perspective, after browsing docs what I'm looking for is already implemented in InsecureClientIp, hence I'm closing the issue.