Indiana 6399039589 fix: resolve real visitor IP via CF-Connecting-IP for per-IP limiting ...

websocket.client.host is always the Cloudflare Tunnel machine's LAN IP for
every internet-facing connection (the tunnel runs on a separate machine and
terminates TLS there), which collapsed per-IP rate limiting into a single
shared bucket for all remote visitors — the exact gap flagged in review.

Cloudflare's edge sets CF-Connecting-IP itself, overwriting any
client-supplied value, so it's safe to trust when present. Falls back to
the raw socket peer for direct LAN/local access.

2026-07-22 23:59:35 +00:00

1.8 KiB

Raw Blame History

View Raw