⚡ perf(req): skip ip.String() alloc in IsProxyTrusted for CIDR-only trust configs

[ReneWerner87]

IsProxyTrusted looked up config.TrustProxyConfig.ips[ip.String()] even when the exact-IP map is empty, so ip.String() heap-allocated on every call for the common CIDR-only / range-based trust setup. Behind a load balancer, IP(), Host(), and Scheme() reach this per request. Guard the lookup with len(ips) > 0.

Adds a WithProxyCheckCIDR benchmark exercising the empty-ips range path.

Benchmark

Benchmark_Ctx_IsProxyTrusted/WithProxyCheckCIDR (CIDR-only trust, remote IP reaches the range check):

	ns/op	B/op	allocs/op
before	~64-84	8	1
after	~27	0	0

Behavior is unchanged: with a non-empty exact-IP map the lookup runs exactly as before (existing WithProxyCheck covers that path).

🤖 Generated with Claude Code

[coderabbitai]

Walkthrough

The IsProxyTrusted method in req.go is optimized to skip the allocation-heavy ip.String() call when the trusted-proxy exact-match IP map is empty, deferring to CIDR/range checks. A new benchmark sub-test in ctx_test.go covers CIDR-only proxy trust configuration.

Changes

IsProxyTrusted optimization

Layer / File(s)	Summary
Conditional exact-match check and benchmark req.go, ctx_test.go	ip.String() is now called only when TrustProxyConfig.ips is non-empty, avoiding unnecessary allocation before exact-match lookup; CIDR-based checks remain unchanged. A new WithProxyCheckCIDR sub-benchmark exercises IsProxyTrusted() with a CIDR-only proxy configuration.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related PRs

• gofiber/fiber#3170: Both PRs modify trusted-proxy logic around IsProxyTrusted() and extend proxy-focused ctx_test.go coverage for CIDR/range vs exact-match behavior.
• gofiber/fiber#4394: Touches the same trusted-proxy trust-check logic used for stripping trusted IPs from X-Forwarded-For.

Suggested reviewers: sixcolors, efectn

Poem

A hop, a skip, no string in sight,
When the map is bare, we take flight! 🐇
CIDR checks still hold the line,
Benchmarks prove the code's just fine.
Less allocation, more delight!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly and concisely describes the performance fix in IsProxyTrusted for CIDR-only trust configs.
Description check	✅ Passed	The description covers the bug, the fix, benchmark results, and unchanged behavior, though it doesn't fully follow the template.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/hotpath-micro-proxy-type

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Pull request overview

Optimizes DefaultReq.IsProxyTrusted() to avoid an unnecessary ip.String() allocation when TrustProxyConfig is configured with CIDR/range entries only (empty exact-IP map), improving per-request performance in common proxy/LB deployments.

Changes:

• Guard exact-IP map lookup behind len(config.TrustProxyConfig.ips) > 0 to skip ip.String() when it would be wasted work.
• Add a new benchmark subcase (WithProxyCheckCIDR) to exercise the CIDR-only path and validate the allocation reduction.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
req.go	Skips ip.String() allocation when TrustProxyConfig.ips is empty, preserving behavior while improving hot-path performance.
ctx_test.go	Adds a benchmark scenario to cover the CIDR-only trust configuration path and measure alloc improvements.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 92.98%. Comparing base (19fd3a0) to head (f972a4a).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #4500   +/-   ##
=======================================
  Coverage   92.98%   92.98%           
=======================================
  Files         139      139           
  Lines       13931    13932    +1     
=======================================
+ Hits        12954    12955    +1     
  Misses        607      607           
  Partials      370      370           

Flag	Coverage Δ
unittests	92.98% <100.00%> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.