Componentpedia / Listings / actix-ip-filter

Last update: 04/05/2025

actix-ip-filter

Actix Middleware for IP filter. Support glob pattern.

Latest version: 0.3.2 registry icon
Maintenance score
36
Safety score
100
Popularity score
71
Check your open source dependency risks. Get immediate insight about security, stability and licensing risks.
De-risk your app now
Security
  Vulnerabilities
Version Suggest Low Medium High Critical
0.3.2 0 0 0 0 0
0.3.1 0 0 0 0 0
0.3.0 0 0 0 0 0
0.2.0 0 0 0 0 0
0.1.3 0 0 0 0 0
0.1.2 0 0 0 0 0
0.1.1 0 0 0 0 0
0.1.0 0 0 0 0 0

Stability
Latest release:

0.3.2 - This version may not be safe as it has not been updated for a long time. Find out if your coding project uses this component and get notified of any reported security vulnerabilities with Meterian-X Open Source Security Platform

Licensing

Maintain your licence declarations and avoid unwanted licences to protect your IP the way you intended.

MIT   -   MIT License

Not a wildcard

Not proprietary

OSI Compliant

actix-ip-filter

Actix Middleware for IP filter. Support glob pattern.

Documentation

Usage

use actix_web::{App, HttpServer, HttpRequest, web, middleware};
use actix_ip_filter::IPFilter;

async fn index(req: HttpRequest) -> &'static str {
    "Hello world"
}

#[tokio::main]
async fn main() -> std::io::Result<()> {
    HttpServer::new(|| App::new()
        // enable logger
        .wrap(middleware::Logger::default())
        // setup ip filters
        .wrap(
            IPFilter::new()
                .allow(vec!["172.??.6*.12"])
                .block(vec!["192.168.1.222"])
                // Optionally use X-Forwarded-For with realip_remote_addr
                // .use_realip_remote_addr(true)
        )
        // register simple route, handle all methods
        .service(web::resource("/").to(index))
    )
        .bind("0.0.0.0:8080")?;
    Ok(())
}

IP Address Extraction Options

The middleware provides several methods to extract the client IP address:

  1. Default: Uses the peer address from the socket connection
  2. X-REAL-IP: Extracts the IP from the X-REAL-IP header if present with .x_real_ip(true)
  3. X-Forwarded-For: Uses Actix's built-in realip_remote_addr() method with .use_realip_remote_addr(true), which extracts the client IP from the X-Forwarded-For header

When deployed behind proxies like AWS Elastic Load Balancer that set the X-Forwarded-For header instead of X-REAL-IP, using the use_realip_remote_addr option is recommended:

use actix_ip_filter::IPFilter;

let filter = IPFilter::new()
    .allow(vec!["192.168.1.*"])
    .use_realip_remote_addr(true);

Limiting to certain paths

You can limit the allow/block actions to a certain set of patterns representing URL paths. The following code will only allow/block to paths matching the patterns /my/path* and /my/other/*.csv.

use actix_web::{App, HttpServer, HttpRequest, web, middleware};
use actix_ip_filter::IPFilter;

async fn i_am_protected() -> &'static str {
    "I am a protected resource"
}

async fn i_am_unprotected() -> &'static str {
    "I am NOT a protected resource"
}

#[tokio::main]
async fn main() -> std::io::Result<()> {


    HttpServer::new(|| App::new()
        // enable logger
        .wrap(middleware::Logger::default())
        // setup ip filters
        .wrap(
            IPFilter::new()
                .allow(vec!["172.??.6*.12"])
                .block(vec!["192.168.1.222"])
                .limit_to(vec!["/my/path/*"])
        )
        // register simple protected route
        .service(web::resource("/my/path/resource").to(i_am_protected))
        // register simple unprotected route
        .service(web::resource("/other/path/resource").to(i_am_unprotected))
    )
        .bind("0.0.0.0:8000");
    Ok(())
}

Allow and block callbacks

You can add an allow handler and a block handler. These handlers will be called whenever a request succeeds at passing an ip filter (allow handler) or it is blocked (block handler). This last allows you to customize the error response. The callbacks will not be called on unprotected paths.

The allow handler.

The allow handler must take three positional arguments and no return type:

use actix_ip_filter::IPFilter;
use actix_web::dev::ServiceRequest;

fn my_allow_handler(flt: &IPFilter, ip: &str, req: &ServiceRequest) {
    //Do smth
}

The parameters passed to the functions are borrows of the IPFilter, the ip of the request and the request.

You can attach the handler to an IPFilter like this:

use actix_web::{App, HttpServer, HttpRequest, web, middleware};
use actix_ip_filter::IPFilter;
use actix_web::dev::ServiceRequest;

fn my_allow_handler(flt: &IPFilter, ip: &str, req: &ServiceRequest) {
    //Do smth
}

async fn i_am_protected() -> &'static str {
    "I am a protected resource"
}

async fn i_am_unprotected() -> &'static str {
    "I am NOT a protected resource"
}

#[tokio::main]
async fn main() -> std::io::Result<()> {


    HttpServer::new(|| App::new()
        // enable logger
        .wrap(middleware::Logger::default())
        // setup ip filters
        .wrap(
            IPFilter::new()
                .allow(vec!["172.??.6*.12"])
                .block(vec!["192.168.1.222"])
                .limit_to(vec!["/my/path/*"])
                .on_allow(my_allow_handler)
        )
        // register simple protected route
        .service(web::resource("/my/path/resource").to(i_am_protected))
        // register simple unprotected route
        .service(web::resource("/other/path/resource").to(i_am_unprotected))
    )
        .bind("0.0.0.0:8000");
    Ok(())
}

The block handler

The allow handler must take three positional arguments and and optional body response as a response:

use actix_ip_filter::IPFilter;
use actix_web::dev::ServiceRequest;
use actix_web::HttpResponse;

fn my_block_handler(flt: &IPFilter, ip: &str, req: &ServiceRequest) -> Option<HttpResponse> {
    Some(HttpResponse::UseProxy().json("{\"result\": \"error\"}"))
}

The parameters passed to the functions are borrows of the IPFilter, the ip of the request and the request.

If the handler returns None, then the default error response is used. You can attach the handler to an IPFilter like this:

use actix_web::{App, HttpServer, HttpRequest, web, middleware};
use actix_ip_filter::IPFilter;
use actix_web::dev::ServiceRequest;
use actix_web::HttpResponse;

fn my_block_handler(flt: &IPFilter, ip: &str, req: &ServiceRequest) -> Option<HttpResponse> {
    Some(HttpResponse::UseProxy().json("{\"result\": \"error\"}"))
}

async fn i_am_protected() -> &'static str {
    "I am a protected resource"
}

async fn i_am_unprotected() -> &'static str {
    "I am NOT a protected resource"
}

#[tokio::main]
async fn main() -> std::io::Result<()> {


    HttpServer::new(|| App::new()
        // enable logger
        .wrap(middleware::Logger::default())
        // setup ip filters
        .wrap(
            IPFilter::new()
                .allow(vec!["172.??.6*.12"])
                .block(vec!["192.168.1.222"])
                .limit_to(vec!["/my/path/*"])
                .on_block(my_block_handler)
        )
        // register simple protected route
        .service(web::resource("/my/path/resource").to(i_am_protected))
        // register simple unprotected route
        .service(web::resource("/other/path/resource").to(i_am_unprotected))
    )
        .bind("0.0.0.0:8000");
    Ok(())
}

License: MIT