Aleksey Shakhmatov 2d4a06e715 Harden RateLimit against X-Forwarded-For spoofing ...

Key on RemoteAddr by default; honor X-Forwarded-For only when the peer is
a configured trusted proxy (WithTrustedProxies), walking right-to-left to
the first untrusted hop. This closes a trivial rate-limit bypass and the
matching unbounded-bucket DoS via spoofed headers. Add WithMaxKeys with
opportunistic eviction of idle (fully-refilled) buckets to bound memory.
Drop the hand-rolled indexOf in favor of stdlib.

2026-05-23 13:47:08 +03:00

1.8 KiB

Raw Blame History

View Raw