The search endpoint unconditionally trusts the leftmost X-Forwarded-For value and stores a bucket for every accepted client identifier. Without a guaranteed sanitizing proxy, callers can spoof identities to bypass per-IP limits and grow the in-memory store.
Acceptance
- Proxy-derived client identity is used only under an explicit, documented trusted-proxy configuration.
- Spoofed or malformed forwarding headers cannot create arbitrary rate-limit identities when proxy trust is disabled.
- The in-memory store has a bounded growth strategy and preserves expiry cleanup without keeping the process alive unnecessarily.
- Tests cover direct connections, trusted proxy headers, spoofed or malformed multi-hop headers, window resets, and store cleanup and bounds.
- Deployment documentation states the expected proxy/header configuration and the per-process limitation.
- Formatting, linting, type checking, tests, local indexing, and the production build pass.
Tasks
The search endpoint unconditionally trusts the leftmost
X-Forwarded-Forvalue and stores a bucket for every accepted client identifier. Without a guaranteed sanitizing proxy, callers can spoof identities to bypass per-IP limits and grow the in-memory store.Acceptance
Tasks
gh-76-1- Define and implement explicit proxy-trust client identification.gh-76-2- Bound the in-memory rate-limit store and cleanup lifecycle.gh-76-3- Add spoofing, proxy-chain, reset, and cleanup regression tests.gh-76-4- Document deployment assumptions and per-process behavior.gh-76-5- Run the full quality and build validation suite.