axum-client-ip

Crates.ioaxum-client-ip
lib.rsaxum-client-ip
version
sourcesrc
created_at2022-02-09 05:21:05.494742+00
updated_at2025-04-02 09:11:53.384078+00
descriptionClient IP address extractors for Axum
homepage
repositoryhttps://github.com/imbolc/axum-client-ip
max_upload_size
id529515
Cargo.toml error:TOML parse error at line 17, column 1 | 17 | autolib = false | ^^^^^^^ unknown field `autolib`, expected one of `name`, `version`, `edition`, `authors`, `description`, `readme`, `license`, `repository`, `homepage`, `documentation`, `build`, `resolver`, `links`, `default-run`, `default_dash_run`, `rust-version`, `rust_dash_version`, `rust_version`, `license-file`, `license_dash_file`, `license_file`, `licenseFile`, `license_capital_file`, `forced-target`, `forced_dash_target`, `autobins`, `autotests`, `autoexamples`, `autobenches`, `publish`, `metadata`, `keywords`, `categories`, `exclude`, `include`
size0
Imbolc (imbolc)

documentation

README

axum-client-ip

License Crates.io Docs.rs

Client IP address extractors for Axum

V1 breaking changes

  • Removed InsecureClientIp and related "leftmost" IP logic. The library now focuses solely on secure extraction based on trusted headers.
  • Renamed SecureClientIp to ClientIp.
  • Renamed SecureClientIpSource to ClientIpSource.

The changes are triggered by "rightmost" IP extraction bug.

Configurable vs specific extractors

There's a configurable [ClientIp] extractor you can use to make your application independent from a proxy it can run behind (if any) and also separate extractors for each proxy / source header.

Extractor / ClientIpSource Variant Header Used Typical Proxy / Service
CfConnectingIp CF-Connecting-IP Cloudflare
CloudFrontViewerAddress CloudFront-Viewer-Address AWS CloudFront
FlyClientIp Fly-Client-IP Fly.io
RightmostForwarded Forwarded Proxies supporting RFC 7239 (extracts rightmost for=)
RightmostXForwardedFor X-Forwarded-For Nginx, Apache, HAProxy, CDNs, LBs
TrueClientIp True-Client-IP Cloudflare, Akamai
XRealIp X-Real-Ip Nginx
ConnectInfo N/A (uses socket address) No proxy, e.g. listening directly to 80 port

Configurable extractor

The configurable extractor assumes initializing [ClientIpSource] at runtime (e.g. with an environment variable). This makes sense when you ship a pre-compiled binary, people meant to use in different environments. Here's an initialization example.

Specific extractors

Specific extractors don't require runtime initialization, but you'd have to recompile your binary when you change proxy server.

// With the renaming, you have to change only one line when you change proxy
use axum_client_ip::XRealIp as ClientIp;

async fn handler(ClientIp(ip): ClientIp) {
    todo!()
}

Contributing

  • please run .pre-commit.sh before sending a PR, it will check everything

License

This project is licensed under the MIT license.

Commit count: 57

cargo fmt