ratelimit: ClientIP ignores X-Forwarded-For behind a proxy #527

New issue

Open

opened 2026-08-04 19:36:55 +00:00 by the.auditor · 0 comments

the.auditor commented

2026-08-04 19:36:55 +00:00

Owner

internal/ratelimit keys buckets on gin.Context.ClientIP(), but the daemon never configures trusted proxies (SetTrustedProxies/TrustedProxies), so behind a reverse proxy or the Helm-chart ingress, ClientIP() resolves to the proxy's address for every request. Per-IP limiting then collapses into a single global bucket for all clients (and the 1024-entry cap becomes moot).

Context: PR #526 (internal/ratelimit/ratelimit.go:53).

Suggested fix: add a trusted-proxies/forwarded-headers config and honor X-Forwarded-For, or document that per-IP limiting only works for direct connections.

`internal/ratelimit` keys buckets on `gin.Context.ClientIP()`, but the daemon never configures trusted proxies (`SetTrustedProxies`/`TrustedProxies`), so behind a reverse proxy or the Helm-chart ingress, `ClientIP()` resolves to the proxy's address for every request. Per-IP limiting then collapses into a single global bucket for all clients (and the 1024-entry cap becomes moot). Context: PR #526 (`internal/ratelimit/ratelimit.go:53`). Suggested fix: add a trusted-proxies/forwarded-headers config and honor `X-Forwarded-For`, or document that per-IP limiting only works for direct connections.

the.auditor added the

Kind/Enhancement

Priority

Medium

labels

2026-08-04 19:37:02 +00:00