docs: elaborate on X-Forwarded-For header #314
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
oddgrd
reviewed
Jan 6, 2025
| #### X-Forwarded-For | ||
| `X-Forwarded-For` is a header that allows you to get the original IP of the HTTP request. Deployed Shuttle projects sit behind a proxy, meaning that when you try to get the IP address normally you may end up with the proxy IP instead of the requester IP. With the `X-Forwarded-For` header, you can now always get the requester IP by parsing the given header value. | ||
|
|
||
| To implement your own custom rate limiting, our [blog post on how to write API rate limiting yourself](https://www.shuttle.dev/blog/2024/02/22/api-rate-limiting-rust) may prove useful. You can also additionally implement your own middleware that utilises the `governor` crate, as seen on [`tower-governor`](https://docs.rs/tower_governor/latest/tower_governor/) and [`actix-governor`](https://docs.rs/actix-governor/latest/actix_governor/). |
There was a problem hiding this comment.
I'm not sure if this is the right place to link to rate limiting guides, as it's not the only use-case. I feel it would be more appropriate to link to the documentation for this header in the rate limiting guides themselves.
| ### Request Headers | ||
|
|
||
| #### X-Forwarded-For | ||
| `X-Forwarded-For` is a header that allows you to get the original IP of the HTTP request. Deployed Shuttle projects sit behind a proxy, meaning that when you try to get the IP address normally you may end up with the proxy IP instead of the requester IP. With the `X-Forwarded-For` header, you can now always get the requester IP by parsing the given header value. |
There was a problem hiding this comment.
Should we make it a bit more concise, perhaps like this?
Suggested change
| `X-Forwarded-For` is a header that allows you to get the original IP of the HTTP request. Deployed Shuttle projects sit behind a proxy, meaning that when you try to get the IP address normally you may end up with the proxy IP instead of the requester IP. With the `X-Forwarded-For` header, you can now always get the requester IP by parsing the given header value. | |
| Deployed Shuttle projects sit behind a proxy, so if you extract the peer address of the incoming connection in your application, it will be the address of our proxy. To allow you to get the IP address of the original client, the Shuttle proxy will set it in the `X-Forwarded-For` (link to the mdn docs for the header here) header in all requests to your project. |
We are also using the header incorrectly, it should be a comma separated list of IPs, including the IP of our proxy. If it's just the original client IP, we should have a new custom header, as I understand it. But we can address that later.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
First draft for an elaboration on how exactly to use the
X-Forwarded-Forheader.