From 37c83d9a3fb93c595a677986dafd0317508a6035 Mon Sep 17 00:00:00 2001 From: Pratyush-Panda-2006 Date: Sun, 2 Aug 2026 22:24:28 +0530 Subject: [PATCH] fix(security): prevent X-Forwarded-For header spoofing rate limiter bypass (fix #1051) --- backend/src/middleware/rateLimiter.js | 2 +- backend/src/server.js | 2 ++ 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/backend/src/middleware/rateLimiter.js b/backend/src/middleware/rateLimiter.js index ed952d7..520c629 100644 --- a/backend/src/middleware/rateLimiter.js +++ b/backend/src/middleware/rateLimiter.js @@ -15,7 +15,7 @@ const rateLimiter = async (req, res, next) => { } try { - const ip = req.headers["x-forwarded-for"]?.split(",")[0].trim() || req.socket.remoteAddress || req.ip; + const ip = req.ip || req.socket?.remoteAddress || "global-rate-limit"; const identifier = req.user?._id || ip || "global-rate-limit"; const { success } = await ratelimit.limit(identifier); if (!success) { diff --git a/backend/src/server.js b/backend/src/server.js index c6a5a3f..517a03d 100644 --- a/backend/src/server.js +++ b/backend/src/server.js @@ -27,6 +27,8 @@ dotenv.config(); dns.setServers(["1.1.1.1", "8.8.8.8"]); const app = express(); +// Enable trust proxy for reverse proxies (Render, Vercel, Nginx) +app.set("trust proxy", 1); const __filename = fileURLToPath(import.meta.url); const __dirname = path.dirname(__filename);