Without Express's trust-proxy setting, req.ip resolves to the load balancer's own connecting IP for every request in production, not the real client IP. That silently broke per-IP rate limiting: every user behind the same proxy shared one 100-requests-per-60-seconds throttler bucket instead of getting their own, so any real traffic volume (the dashboard alone fires ~6 requests per load) could 429 everyone, including on login/registration.
Description
No description provided
Languages
TypeScript
85%
JavaScript
14.9%
Dockerfile
0.1%