Description
gin.Engine defaults TrustedProxies to trusting all IPs. When deployed behind a reverse proxy, c.ClientIP() returns whatever X-Forwarded-For says — which is spoofable by any client. This makes the IP-based rate limiter and the logged client_ip trivially bypassable.
Location
router/router.go:28 (engine creation)middleware/rate_limit.go:67
Fix
Call r.SetTrustedProxies([]string{"127.0.0.1"}) (or the actual proxy CIDRs) after creating the engine, or expose a TRUSTED_PROXIES config variable.
Description
gin.EnginedefaultsTrustedProxiesto trusting all IPs. When deployed behind a reverse proxy,c.ClientIP()returns whateverX-Forwarded-Forsays — which is spoofable by any client. This makes the IP-based rate limiter and the loggedclient_iptrivially bypassable.Location
router/router.go:28(engine creation)middleware/rate_limit.go:67Fix
Call
r.SetTrustedProxies([]string{"127.0.0.1"})(or the actual proxy CIDRs) after creating the engine, or expose aTRUSTED_PROXIESconfig variable.