Problem
Rate limiting uses request.client.host directly. Behind a reverse proxy this may rate-limit the proxy itself, while trusting forwarded headers without configuration could allow spoofing.
Acceptance criteria
- Decide and document the supported deployment behavior.
- If proxy headers are supported, configure trusted proxies explicitly.
- Add tests for the selected client-IP behavior.
Problem
Rate limiting uses
request.client.hostdirectly. Behind a reverse proxy this may rate-limit the proxy itself, while trusting forwarded headers without configuration could allow spoofing.Acceptance criteria