your rate limiter trusts x-forwarded-for. mine did too, until it was measured.

Mon, 22 Dec 2025 00:00:00 +0000

last time i told you about the elo race that ate 79% of every vote — the anchor finding from a pre-launch hardening pass on a little pairwise-voting side project. i promised, at the bottom of that post, that the other critical finding was a vote rate-limiter that a rotated header walked straight through. this is that post.

here’s the setup. the side project is a nougat-ranking toy: you get shown two flavours, you pick one, an elo rating moves, a leaderboard falls out. because the leaderboard is the entire point, the interesting attack is obvious — cast a pile of votes for your favourite and bend the ranking. so i’d put a rate limiter in front of it. two, actually. i felt responsible.

then, during the audit, i sat down and attacked them instead of admiring them. both fell over. one to a header i let the open internet write. one to a cookie i simply didn’t send. neither took more than a few lines of curl.

a limiter you have never fired a spoofed header at is not a limiter. it’s a comment.

rate-limiting on krtffl.dev

your rate limiter trusts x-forwarded-for. mine did too, until it was measured.