DorianandClaude Opus 4.6 5bf557ba6a fix: only trust proxy headers in rate-limit when TRUSTED_PROXY is set ...

X-Forwarded-For, X-Real-IP, and CF-Connecting-IP headers were
blindly trusted, allowing attackers to bypass rate limiting by
spoofing different IPs. Now only trusted when TRUSTED_PROXY env
var is configured. Falls back to Node.js socket remoteAddress.

Add tests verifying proxy headers are ignored without TRUSTED_PROXY
and respected when it is set.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

2026-03-13 09:23:10 +00:00

..

scripts

test: load testing script

2026-03-09 00:30:43 +00:00

src

fix: only trust proxy headers in rate-limit when TRUSTED_PROXY is set

2026-03-13 09:23:10 +00:00

botfights.db

feat: SSE live fight spectating with spectator count

2026-03-08 19:46:39 +00:00

drizzle.config.ts

feat: botfights v1 — full fighting game with Kaplay engine

2026-03-06 16:27:54 +00:00

package.json

chore: pin all dependency versions for reproducible builds

2026-03-13 06:21:16 +00:00

tsconfig.json

feat: botfights v1 — full fighting game with Kaplay engine

2026-03-06 16:27:54 +00:00