[Security] Rate limit bypass via X-Forwarded-For spoofing #45
Description
Summary
Rate limits can be bypassed by spoofing the X-Forwarded-For header.
Affected Code
server-services/start-services.jsLine 178
Vulnerability
The code trusts X-Forwarded-For from all connections, not just trusted proxies.
Impact
- Bypass login/register rate limits
- Spam sensitive endpoints
- Brute-force accounts
Recommended Fix
Only trust X-Forwarded-For when req.socket.remoteAddress is in a trusted-proxies allowlist.