Function caller_key 

pub fn caller_key(
    headers: &HeaderMap,
    peer: Option<IpAddr>,
    trust_forwarded_headers: bool,
) -> String

Names the caller a RateLimiter should key its budget on.

peer is the TCP socket’s own address — see this module’s doc for how a handler gets one — and is what this returns unless trust_forwarded_headers says to read X-Forwarded-For/X-Real-IP instead. peer being None (no [ConnectInfo] reached the handler) and trust_forwarded_headers being true with neither header present both answer the same "unknown", the shared bucket every caller falls back to when this cannot tell them apart.

An IPv6 address is keyed on its /64, because one host routinely holds a whole /64. An IPv4-mapped IPv6 address is keyed as its IPv4 address. A forwarded value that is not an address at all leaves the caller on the TCP peer’s budget, so a caller cannot open a bucket of its own by inventing a string to be keyed under.