From b16a6f9e16140ddc3971222172f9b4de6c134ef3 Mon Sep 17 00:00:00 2001
From: Aroh Maurya <aroh3006@gmail.com>
Date: Mon, 12 Oct 2026 01:36:24 +0530
Subject: [PATCH] fix RATE_LIMIT_BY=ip to use req.ip instead of a
 client-controlled header (#568)

---
 app.js | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/app.js b/app.js
index 1ec35c6..2798820 100644
--- a/app.js
+++ b/app.js
@@ -144,7 +144,8 @@ const limiter = rateLimit({
         const token = req.headers.authorization?.split(' ')[1] || '127.0.0.1';
         return token;
       case 'ip':
-        return req.headers['x-real-ip'];
+        // req.ip (not a raw header) so this respects trust proxy and cannot be spoofed by the client
+        return req.ip;
       default:
         return '127.0.0.1';
     }