x-forwarded-for first-IP spoofing on Vercel

[ryota-murakami]

Summary

getForwardedClientIp takes split(',')[0], which on Vercel can be attacker-controlled.

Source

P2 follow-up from /ship adversarial review of PR #176 (silent GitHub token refresh).

Details

On Vercel, x-forwarded-for is appended to (not replaced), so the first hop is the client-controllable value. Bypass is rate-limit-only and requires authenticated session, but it still defeats per-IP throttling.

Fix

Switch to x-real-ip (Vercel-set) or read the LAST entry of x-forwarded-for.

Acceptance

• IP extraction uses trusted edge-set header
• Tests cover spoofed x-forwarded-for chains
• No rate-limit bypass via header injection