From 278c9a25452de47e843b8ac831d6961858fb245d Mon Sep 17 00:00:00 2001 From: Do Siki Date: Mon, 17 Aug 2026 17:31:31 +0200 Subject: [PATCH] fix: rate limit CMS clients by forwarded address --- content-editor.js | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/content-editor.js b/content-editor.js index a8783d9..6d210f0 100644 --- a/content-editor.js +++ b/content-editor.js @@ -459,6 +459,12 @@ function securityConfigIsValid() { } function getClientAddress(req) { + // The editor only listens on 127.0.0.1; the staging Nginx proxy supplies this header. + // This prevents all remote visitors sharing the proxy address in the rate limiter. + const forwarded = req.headers['x-forwarded-for']; + if (typeof forwarded === 'string' && forwarded.trim()) { + return forwarded.split(',')[0].trim(); + } return req.socket.remoteAddress || 'unknown'; }