From 1d715e6a643a91a81c00613e4d98e946fcc90ad2 Mon Sep 17 00:00:00 2001 From: Thomas Joise Date: Sat, 18 Jul 2026 01:11:41 +0530 Subject: [PATCH] fix(sec/d24): nginx sends X-Forwarded-For as $remote_addr (replace, not append) With the app's trust-proxy=1, an appended client-supplied XFF header would let a caller spoof req.ip and bypass the per-IP login/reveal rate limiters. Replacing with $remote_addr (the unforgeable socket peer) keys the limiters on the true client. Co-Authored-By: Claude Fable 5 --- deploy/sims.hq.conf | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/deploy/sims.hq.conf b/deploy/sims.hq.conf index 18f935d..b420454 100644 --- a/deploy/sims.hq.conf +++ b/deploy/sims.hq.conf @@ -24,7 +24,12 @@ server { proxy_pass http://127.0.0.1:5182; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + # REPLACE, do not append (D24 red-team). With the app's `trust proxy 1`, Express + # reads the last X-Forwarded-For hop as the client IP. $proxy_add_x_forwarded_for + # would append to a CLIENT-SUPPLIED header, letting a caller inject a fake IP and + # bypass the per-IP login/reveal rate limiters. $remote_addr is the real socket + # peer and cannot be forged, so the app always keys limits on the true client. + proxy_set_header X-Forwarded-For $remote_addr; proxy_set_header X-Forwarded-Proto $scheme; } }