security vulnerability_error ai_generated true

Rate limit bypassed via header manipulation

ID: security/rate-limit-bypass

Also available as: JSON · Markdown
80%Fix Rate
84%Confidence
3Evidence
2023-01-01First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
any active — — —

Root Cause

Rate limiting bypassed using IP spoofing headers.

generic

Workarounds

  1. 90% success Rate limit by authenticated user ID when possible
  2. 88% success Use the real client IP from trusted proxy (rightmost non-private)

Dead Ends

Common approaches that don't work:

  1. Trust X-Forwarded-For header directly 90% fail

    Trivially spoofable by client

  2. Rate limit by user-agent only 88% fail

    Easily changed by attacker