fix: prevent rate limit bypass via spoofed X-Forwarded-For headers

Author: anshika1179

app/api/track-user/route.ts

@@ -2,16 +2,13 @@ import { NextResponse } from 'next/server';
 import dbConnect from '@/lib/mongodb';
 import { User } from '@/models/User';
 import { trackUserRateLimiter } from '@/lib/rate-limit';
+import { getClientIp } from '@/utils/getClientIp';
 
 export async function POST(req: Request) {
-  // Get IP for rate limiting.
-  // x-real-ip is provided by Vercel/Nginx as the true client IP.
-  // We fall back to the LAST IP in the x-forwarded-for chain, which is appended by the Vercel proxy.
-  const forwardedFor = req.headers.get('x-forwarded-for');
-  const fallbackIp = forwardedFor ? forwardedFor.split(',').pop()?.trim() : 'unknown';
-  const ip = req.headers.get('x-real-ip') || fallbackIp || 'unknown';
+  // Get IP for rate limiting securely
+  const ip = getClientIp(req);
 
-  if (ip !== 'unknown' && !(await trackUserRateLimiter.check(ip))) {
+  if (ip !== '127.0.0.1' && ip !== 'unknown' && !(await trackUserRateLimiter.check(ip))) {
     return NextResponse.json(
       { success: false, error: 'Too many requests, please try again later.' },
       { status: 429 }

middleware.test.ts

@@ -1,4 +1,4 @@
-import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { beforeEach, afterEach, describe, expect, it, vi } from 'vitest';
 import { NextRequest, NextResponse } from 'next/server';
 import { middleware } from './middleware';
 import { rateLimit } from '@/lib/rate-limit';
@@ -8,8 +8,17 @@ vi.mock('@/lib/rate-limit', () => ({
 }));
 
 describe('middleware', () => {
+  let originalEnv: string | undefined;
+
   beforeEach(() => {
     vi.clearAllMocks();
+    originalEnv = process.env.TRUSTED_PROXIES;
+    // Set trusted proxies to make standard multi-hop tests pass as trusted proxy chains
+    process.env.TRUSTED_PROXIES = '5.6.7.8, 9.10.11.12';
+  });
+
+  afterEach(() => {
+    process.env.TRUSTED_PROXIES = originalEnv;
   });
 
   it('calls NextResponse.next when rate limit succeeds', async () => {
@@ -86,7 +95,7 @@ describe('middleware', () => {
     expect(response.headers.get('X-RateLimit-Remaining')).toBe('59');
   });
 
-  it('uses first IP from x-forwarded-for', async () => {
+  it('uses first IP from x-forwarded-for when subsequent hops are trusted', async () => {
     vi.mocked(rateLimit).mockResolvedValue({
       success: true,
       limit: 60,
@@ -105,6 +114,29 @@ describe('middleware', () => {
     expect(rateLimit).toHaveBeenCalledWith('1.2.3.4', 60, 60000);
   });
 
+  it('ignores spoofed x-forwarded-for when subsequent hops are untrusted', async () => {
+    vi.mocked(rateLimit).mockResolvedValue({
+      success: true,
+      limit: 60,
+      remaining: 59,
+      reset: 123456789,
+    });
+
+    // Clear trusted proxies so 5.6.7.8 is untrusted
+    process.env.TRUSTED_PROXIES = '';
+
+    const request = new NextRequest('http://localhost:3000/api/streak?user=octocat', {
+      headers: {
+        'x-forwarded-for': '1.2.3.4, 5.6.7.8',
+      },
+    });
+
+    await middleware(request);
+
+    // Should resolve to the untrusted proxy IP (5.6.7.8) instead of the spoofed client IP (1.2.3.4)
+    expect(rateLimit).toHaveBeenCalledWith('5.6.7.8', 60, 60000);
+  });
+
   it('uses x-real-ip if x-forwarded-for is missing', async () => {
     vi.mocked(rateLimit).mockResolvedValue({
       success: true,

middleware.ts

@@ -1,6 +1,7 @@
 import { NextResponse } from 'next/server';
 import type { NextRequest } from 'next/server';
 import { rateLimit } from './lib/rate-limit';
+import { getClientIp } from './utils/getClientIp';
 
 /**
  * Middleware to enforce rate limiting on specific API routes.
@@ -16,11 +17,8 @@ import { rateLimit } from './lib/rate-limit';
  * Limit: 60 requests per minute per IP.
  */
 export async function middleware(request: NextRequest) {
-  // Use Vercel's ip property if available, fallback to headers, then localhost
-  const ip =
-    request.headers.get('x-forwarded-for')?.split(',')[0] ??
-    request.headers.get('x-real-ip') ??
-    '127.0.0.1';
+  // Secure client IP extraction
+  const ip = getClientIp(request);
 
   // Apply rate limiting
   // 60 requests per 60,000ms (1 minute)

package-lock.json

@@ -0,0 +1,26 @@
+export interface TrustedProxyConfig {
+  /**
+   * List of trusted proxy IP addresses or CIDR blocks.
+   * If '*' is present, all proxies are trusted (similar to express trust proxy = true).
+   */
+  trustedProxies: string[];
+
+  /**
+   * Whether to trust default loopback/private IP addresses:
+   * 127.0.0.1, ::1, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, fc00::/7
+   */
+  trustPrivateRanges?: boolean;
+}
+
+export interface GetClientIpOptions {
+  /**
+   * Trusted proxy configuration.
+   */
+  proxyConfig?: TrustedProxyConfig;
+
+  /**
+   * Custom request headers to check first, in order of priority.
+   * E.g., ['x-vercel-forwarded-for', 'cf-connecting-ip', 'x-real-ip']
+   */
+  headersPriority?: string[];
+}

types/network.ts

@@ -0,0 +1,99 @@
+import { describe, expect, it } from 'vitest';
+import { NextRequest } from 'next/server';
+import { getClientIp } from './getClientIp';
+
+describe('getClientIp', () => {
+  it('prefers request.ip on NextRequest if available', () => {
+    const req = new NextRequest('http://localhost:3000/api/streak');
+    Object.defineProperty(req, 'ip', { value: '203.0.113.10', writable: true });
+
+    const ip = getClientIp(req);
+    expect(ip).toBe('203.0.113.10');
+  });
+
+  it('ignores spoofed X-Forwarded-For when request.ip is present', () => {
+    const req = new NextRequest('http://localhost:3000/api/streak', {
+      headers: {
+        'x-forwarded-for': '198.51.100.5, 203.0.113.10',
+      },
+    });
+    Object.defineProperty(req, 'ip', { value: '203.0.113.10', writable: true });
+
+    const ip = getClientIp(req);
+    expect(ip).toBe('203.0.113.10');
+  });
+
+  it('uses direct client-supplied custom priority headers if available', () => {
+    const req = new Request('http://localhost:3000/api/streak', {
+      headers: {
+        'cf-connecting-ip': '198.51.100.99',
+      },
+    });
+
+    const ip = getClientIp(req);
+    expect(ip).toBe('198.51.100.99');
+  });
+
+  it('ignores x-forwarded-for entirely when no trusted proxies are configured', () => {
+    const req = new Request('http://localhost:3000/api/streak', {
+      headers: {
+        'x-forwarded-for': '198.51.100.5, 203.0.113.10',
+      },
+    });
+
+    const ip = getClientIp(req, {
+      proxyConfig: { trustedProxies: [], trustPrivateRanges: false },
+    });
+    expect(ip).toBe('127.0.0.1'); // Default fallback because x-real-ip and others are missing
+  });
+
+  it('extracts correct IP through a trusted proxy chain', () => {
+    const req = new Request('http://localhost:3000/api/streak', {
+      headers: {
+        'x-forwarded-for': '198.51.100.5, 203.0.113.10, 127.0.0.1',
+      },
+    });
+
+    // We trust localhost (127.0.0.1) and 203.0.113.10 as proxies, so the true client is 198.51.100.5
+    const ip = getClientIp(req, {
+      proxyConfig: {
+        trustedProxies: ['127.0.0.1', '203.0.113.10'],
+        trustPrivateRanges: true,
+      },
+    });
+    expect(ip).toBe('198.51.100.5');
+  });
+
+  it('stops at the first untrusted proxy in the chain', () => {
+    const req = new Request('http://localhost:3000/api/streak', {
+      headers: {
+        'x-forwarded-for': '198.51.100.5, 8.8.8.8, 127.0.0.1',
+      },
+    });
+
+    // 127.0.0.1 is trusted. 8.8.8.8 is not. So the resolved IP must be 8.8.8.8.
+    const ip = getClientIp(req, {
+      proxyConfig: {
+        trustedProxies: ['127.0.0.1'],
+        trustPrivateRanges: true,
+      },
+    });
+    expect(ip).toBe('8.8.8.8');
+  });
+
+  it('supports wildcards to trust all proxies (trust-all behavior)', () => {
+    const req = new Request('http://localhost:3000/api/streak', {
+      headers: {
+        'x-forwarded-for': '198.51.100.5, 203.0.113.10',
+      },
+    });
+
+    const ip = getClientIp(req, {
+      proxyConfig: {
+        trustedProxies: ['*'],
+        trustPrivateRanges: false,
+      },
+    });
+    expect(ip).toBe('198.51.100.5');
+  });
+});