HIGH #280: rate limiter bypassable via X-Forwarded-For

Conversation 1 Commits 1 Files Changed 2

+166 -75

1 Commits

Author	SHA1	Message	Date
fen	a0b34378a4	fix #280 : key rate-limit buckets on peer address, not client XFF CI / docker (pull_request) Skipped Details CI / test (pull_request) Successful in 29s Details The deployed ingress does not append the peer to X-Forwarded-For, so the rightmost XFF entry was fully client-controlled and rotating the header gave a fresh rate-limit bucket per request (pentest: 8 creates, 6x201). clientIP() now defaults to the peer (RemoteAddr) and never trusts client-supplied headers. Per-client granularity is restored opt-in via PALETTE_CLIENT_IP_HEADER, honored only when the immediate peer is inside PALETTE_TRUSTED_PROXIES (default loopback + RFC1918) and the value parses as an IP.	2026-09-17 20:34:59 -05:00

Author

SHA1

Message

Date

fen

a0b34378a4

fix #280 : key rate-limit buckets on peer address, not client XFF

CI / docker (pull_request) Skipped

Details

CI / test (pull_request) Successful in 29s

Details

The deployed ingress does not append the peer to X-Forwarded-For, so the
rightmost XFF entry was fully client-controlled and rotating the header
gave a fresh rate-limit bucket per request (pentest: 8 creates, 6x201).

clientIP() now defaults to the peer (RemoteAddr) and never trusts
client-supplied headers. Per-client granularity is restored opt-in via
PALETTE_CLIENT_IP_HEADER, honored only when the immediate peer is inside
PALETTE_TRUSTED_PROXIES (default loopback + RFC1918) and the value
parses as an IP.

2026-09-17 20:34:59 -05:00

HIGH #280: rate limiter bypassable via X-Forwarded-For #287