RateLimit didn't check if trusted proxy send the header x-forwarded-for about moleculer-web

[icebob]

What is your proposal?

[thib3113]

@icebob in fact ... just let the user the responsibility of getting the ip .

Else, we need to manage trusted proxies, and so parse the x-forwarded-for header, to extract the first "not trusted proxy" . Also, sometimes "trusted proxies" can be a cidr, so, we need to check if the ips come from the cidr .... not an esay task .

Also, I think managing trusted proxies (like express do), can be interesting for moleculer-web … but It's not an easy task

[icebob]

Ok, but as you see, it's covered, because this logic just a default value, you can overwrite it in rateLimit options.

[thib3113]

yes I know for the default value . But if it's only a default value, I think it's better to don't use the header req.headers["x-forwarded-for"] .

Users without reverse proxy will be secure, and user with reverse proxy will need to adapt correctly depending on the reverse proxy configuration