Method isTrustedProxyIP

req.go:710–753

isTrustedProxyIP checks whether the given IP string matches any configured trusted proxy.

(ipStr string)

// isTrustedProxyIP checks whether the given IP string matches any configured trusted proxy.
func (r *DefaultReq) isTrustedProxyIP(ipStr string) bool {
	cfg := r.c.app.config.TrustProxyConfig

	ip, err := netip.ParseAddr(ipStr)
	if err != nil {
		return false
	}

	if cfg.Loopback && ip.IsLoopback() {
		return true
	}
	if cfg.Private && ip.IsPrivate() {
		return true
	}
	if cfg.LinkLocal && ip.IsLinkLocalUnicast() {
		return true
	}

	var canonicalIP [net.IPv6len * 3]byte
	if _, trusted := cfg.ips[utils.UnsafeString(ip.AppendTo(canonicalIP[:0]))]; trusted {
		return true
	}
	if len(cfg.ranges) == 0 {
		return false
	}

	if ip.Is4() {
		ipv4 := ip.As4()
		for _, ipNet := range cfg.ranges {
			if ipNet.Contains(ipv4[:]) {
				return true
			}
		}
		return false
	}

	ipv6 := ip.As16()
	for _, ipNet := range cfg.ranges {
		if ipNet.Contains(ipv6[:]) {
			return true
		}
	}
	return false
}

// IPs returns a string slice of IP addresses specified in the X-Forwarded-For request header.
// When IP validation is enabled, only valid IPs are returned.