IP Addresses are not differentiated from one another? about limiter HOT 4 CLOSED

Hello,

Do you have a reverse proxy in front of tour API ?

from limiter.

Not to my knowledge. Maybe Google Cloud Run is doing something I'm not aware of.

I made a rate limited test endpoint that prints the ip of the request and they are different on different devices, so there doesn't seem to be a proxy.

from limiter.

Yeah, pretty sure Google Cloud Run uses a reverse proxy. The different IP is not an argument because it's a best practice to have multiple reverse-proxy for availability.

You should use the TrustForwardHeader option so the library will look at X-Real-IP and/or X-Forwarded-For headers to uses the public IP address.

But be careful, if Google Cloud Run doesn't have a reverse proxy, and my diagnosis is wrong, this could leave you with potential IP spoofing for your limiter.

from limiter.

Thanks, that seems to have fixed the issue!

from limiter.