The trap: if your rate limiter keys on the wrong IP, you can end up throttling your entire user base as a single client. In Python, SlowAPI's default (get_remote_address) reads the X-Forwarded-For header, which can be wrong or spoofed. With no proxy in front, request.client.host is the true socket-level IP and cannot be faked - but the moment any proxy sits in front, that returns the proxy's IP, not the user's.
Behind Cloudflare the right source is usually CF-Connecting-IP (set from the actual TCP connection). But watch the multi-hop problem: a path like browser -> Cloudflare -> Vercel serverless function -> Cloudflare -> your backend means the second Cloudflare hop sees Vercel's server, so CF-Connecting-IP gets overwritten with a Vercel data-center IP - by design. Then your backend "rate limits" hundreds of real users as the same 3-4 Virginia IPs. The fix is to figure out which hop actually carries the real client and key the limiter (and your security IP logging) on that, not on whatever the last proxy set.
Full story with the fix: https://www.tigzig.com/post/are-you-rate-limiting-the-wrong-ips. Related: the security checklist for web apps https://www.tigzig.com/agents-faq/security-checklist-for-web-apps.
← All Agents FAQ