jgrusewski 9495cd39ce fix(web-gateway): use TCP peer address for rate limiting instead of X-Forwarded-For ...

The rate limiter trusted the client-controlled X-Forwarded-For header
to identify clients. An attacker could rotate this header value on every
request to bypass rate limits entirely.

Now uses ConnectInfo<SocketAddr> (the actual TCP connection address) as
the rate limiting key. Server is configured with
into_make_service_with_connect_info to populate this.

X-Forwarded-For and X-Real-Ip headers are no longer consulted.
Falls back to "unknown" if ConnectInfo is unavailable (tests).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

2026-02-23 23:25:05 +01:00

..

auth

safety(web-gateway,web-dashboard): clippy clean, gRPC timeouts, health probes, responsive grids, error boundaries

2026-02-22 08:59:20 +01:00

grpc

safety(web-gateway,web-dashboard): clippy clean, gRPC timeouts, health probes, responsive grids, error boundaries

2026-02-22 08:59:20 +01:00

routes

fix(trading_service): TFT/Mamba2 validate checkpoint exists and propagate inference errors

2026-02-23 23:14:16 +01:00

ws

safety(web-gateway,web-dashboard): WS topic validation, audit logging, API timeouts

2026-02-22 09:45:01 +01:00

config.rs

test(web-gateway): add 26 unit tests for error, config, auth, websocket

2026-02-22 01:32:40 +01:00

error.rs

safety(web-gateway,web-dashboard): harden for production deployment

2026-02-22 08:34:37 +01:00

lib.rs

safety(web-gateway): add per-route-group rate limiting middleware

2026-02-22 09:13:19 +01:00

main.rs

fix(web-gateway): use TCP peer address for rate limiting instead of X-Forwarded-For

2026-02-23 23:25:05 +01:00

rate_limit.rs

fix(web-gateway): use TCP peer address for rate limiting instead of X-Forwarded-For

2026-02-23 23:25:05 +01:00

state.rs

safety(web-gateway,web-dashboard): clippy clean, gRPC timeouts, health probes, responsive grids, error boundaries

2026-02-22 08:59:20 +01:00