🔒 Fix Rate Limiting bypass via X-Forwarded-For Header Smuggling#12
🔒 Fix Rate Limiting bypass via X-Forwarded-For Header Smuggling#12google-labs-jules[bot] wants to merge 1 commit intomainfrom
Conversation
Currently, the rate limiter uses Starlette's `request.headers.get("X-Forwarded-For")` which only extracts the *first* header value. If an attacker sends multiple `X-Forwarded-For` headers with spoofed IPs, the proxy (Caddy) might append its real IP to a subsequent header. The rate limiter then relies on the spoofed IP, successfully bypassing the limit.
This patch fixes the vulnerability by using `request.headers.getlist("X-Forwarded-For")` to collect all headers, join them with commas, and extract the genuinely appended last IP.
Included a new unittest to guarantee robust parsing and protection against multiple and comma-separated header variations.
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
🎯 What: The rate limiter could be bypassed by an attacker sending multiple
⚠️ Risk: An attacker could execute denial-of-service (DoS) attacks or mass abuse the application's endpoints by easily generating a new random spoofed IP in the first
X-Forwarded-Forheaders with spoofed IP addresses. Starlette'sHeaders.getonly evaluates the first instance of a header, ignoring subsequent ones (including the real IP appended by the proxy/Caddy).X-Forwarded-Forheader for each request, exhausting resources and API limits.🛡️ Solution: The solution changes the implementation to retrieve all header values using
request.headers.getlist("X-Forwarded-For"). It correctly concatenates them into a single string to safely and reliably extract the proxy's appended IP from the end. Furthermore, robust unittests have been added to verify this fix handles multiple header instances correctly.PR created automatically by Jules for task 7807520127271089380 started by @dzaczek