safe-global / safe-client-gateway / 27614994538

90%

main: 90%

Build Type

Pull #3170

github

Committed by compojoom

Commit Message

fix: key rate limits on real client IP via trust proxy

The shared RateLimitGuard, captcha guard and blocklist guard read
req.ip, which without Express `trust proxy` resolves to the ingress
pod IP instead of the client. All clients behind an ingress pod
therefore shared a single rate-limit bucket, tripping the spaces,
OIDC-auth and address-book limits platform-wide.

Set `trust proxy` (env EXPRESS_TRUST_PROXY, default
`loopback, uniquelocal`, configurable per env) so req.ip is the real
client, and drop the spoofable getClientIp helper in favour of req.ip.

Pull Request Pull Request #3170: fix: key rate limits on real client IP via trust proxy

Coverage Stats

4622 of 5495 branches covered (84.11%)

Branch coverage included in aggregate %.

6 of 6 new or added lines in 2 files covered. (100.0%)

1 existing line in 1 file now uncovered.

17105 of 18564 relevant lines covered (92.14%)

595.94 hits per line