TrustedProxy class

Decides when to believe X-Forwarded-For / X-Forwarded-Proto.

Those headers are easy to fake. Dox only reads them when the direct client (the socket peer) is one of the configured proxies.

Constructors

TrustedProxy(List<String> proxies)

Properties

enabled → bool

no setter

hashCode → int

The hash code for this object.

no setter, inherited

runtimeType → Type

A representation of the runtime type of the object.

no setter, inherited

Methods

clientIp(String remote, String? forwardedFor) → String

real client ip. walk X-Forwarded-For from the right and skip our own proxies, so a fake value added by the client on the left is ignored.

noSuchMethod(Invocation invocation) → dynamic

Invoked when a nonexistent method or property is accessed.

inherited

scheme(String remote, String? forwardedProto) → String

https when a trusted proxy says the client used https

toString() → String

A string representation of this object.

inherited

trusts(String ip) → bool

is ip one of our proxies?

Operators

operator ==(Object other) → bool

The equality operator.

inherited

Static Methods

normalize(String ip) → String

::ffff:1.2.3.4 becomes 1.2.3.4. The server listens on IPv6, so IPv4 clients come in this form. Other values stay the same.

readClient(HttpRequest req, List<String> trusted) → ({String? ip, String scheme})

The client ip and scheme of req. trusted is the trustedProxies setting. It is parsed once per isolate.