IP Spoofing in Rate Limiter

[roshankumar0036singh]

Problem Statement

The rate limiter relies directly on c.ClientIP(). When deployed behind reverse proxies or load balancers (like Nginx, Cloudflare), malicious users can easily bypass rate limits by spoofing the X-Forwarded-For header.

Technical Approach

Explicitly configure Gin's SetTrustedProxies with the known internal IP ranges of the load balancers, ensuring c.ClientIP() only parses headers from trusted sources.

Acceptance Criteria

• Rate limiting cannot be bypassed by injecting fake IP headers.
• Genuine client IPs are accurately logged in the audit trail.

[Itsssaksham]

can you assign this issue to me ?

[arcgod-design]

Hi @roshankumar0036singh! I'd love to work on this as part of SSoC '26.

My Approach:

• Remove reliance on X-Forwarded-For or X-Real-IP headers for IP identification, as these can be trivially spoofed by clients
• Configure the rate limiter to use the actual TCP connection IP (i.e., req.socket.remoteAddress / req.connection.remoteAddress) as the authoritative source
• If a reverse proxy is in use, validate and whitelist trusted proxy IPs, and only trust forwarded headers from those whitelisted proxies
• Add tests simulating spoofed header scenarios to confirm the fix works correctly

Could you please assign this to me (@arcgod-design)? Thank you!