[Security] Express trust proxy is not configured, so per-IP rate limiting and audit-log IPs use the proxy address #1069

Telegram (ask questions / claim the issue here first): https://t.me/+DOylgFv1jyJlNzM0

Labels: bug, security

app.ts never sets trust proxy, so behind a load balancer every request looks like it came from the proxy, and that quietly guts our per-IP rate limiting.

The global limiter plus ipLoginRateLimiter, challengeRateLimiter, and verifyRateLimiter all key on req.ip, and the auth-failure and audit logs record req.ip too. Behind a reverse proxy, req.ip is the proxy socket address, not the client. Production runs secure cookies and HSTS and we have a staging docker deploy, so this is the real deployment shape. Two consequences: brute-force protection collapses into one shared bucket for everyone, and every audit and auth log records the wrong client IP, so the logs are useless for forensics. express-rate-limit also throws X-Forwarded-For validation warnings in this state. The fix is small but it's a genuine security-control regression.

What the fix has to hold to

• Drive trust proxy from an env var (a proxy hop count, say) with a safe local-dev default. Don't hardcode true.
• Once it's set, req.ip resolves to the real client and rate-limit buckets are per-client.
• Don't touch rate-limit thresholds or windows.
• Document the setting with the other deployment env vars.

Done when

• trust proxy comes from an env var (e.g. proxy hop count) with a safe default for local dev.
• With a simulated X-Forwarded-For, req.ip resolves to the client and rate-limit buckets are per client.
• The setting is documented next to the other deployment env vars.
• A test confirms per-client IP resolution behind a simulated proxy; lint/format green, CI passes.

Where to start
Add the trust proxy config in backend/src/app.ts, then confirm backend/src/middleware/rateLimiter.ts and backend/src/middleware/auditLog.ts now see the right req.ip, and document the env var. Out of scope: changing thresholds or windows. Small config fix, 1-2 days.