X-Forwarded-For misconfiguration can silently break your app's rate limiter

When an application runs behind a reverse proxy or tunnel, incoming TCP connections appear to originate from the relay server rather than the real client. This causes rate limiters to throttle the proxy instead of individual users, meaning one bad actor can block all traffic or bad actors can bypass limits entirely. Proxies typically pass the original client IP via the X-Forwarded-For header, but blindly trusting this header allows clients to spoof any IP address. The correct fix is to configure a trusted proxy list in your framework so that forwarded headers are only accepted from relay servers you control. As tunnels become standard for webhook testing and local development, choosing tools that correctly set and document forwarded headers is increasingly important for application security.