Rules Hub
Coding Rules Library
Rule priority, scope & exceptions
Use this to align rules with the senior-level structure (P0/P1/P2, scope, exceptions/tradeoffs).
Derive IP rate-limit keys from a verified proxy trust policy
Do not key abuse controls on an arbitrary X-Forwarded-For entry. Resolve the client address using verified proxy trust and the actual request path; a per-target quota does not cap total abuse when an attacker can vary targets.
Bad example
| 1 | import type { Request } from 'express'; |
| 2 | export function ipBucket(req: Request): string { |
| 3 | const ip = req.get('x-forwarded-for')?.split(',')[0].trim(); |
| 4 | return `ip:${ip ?? 'unknown'}`; |
| 5 | } |
Explanation (EN)
A client can rotate a spoofed leading header entry and receive fresh IP buckets.
Objašnjenje (HR)
Klijent može mijenjati lažni prvi unos zaglavlja i dobivati nove IP kvote.
Good example
| 1 | import type { Express, Request } from 'express'; |
| 2 | export function configureIngress(app: Express, verifiedProxyAddresses: string[]): void { |
| 3 | app.set('trust proxy', verifiedProxyAddresses); |
| 4 | } |
| 5 | export function ipBucket(req: Request): string { |
| 6 | if (!req.ip) throw new Error('Client address is unavailable'); |
| 7 | return `ip:${req.ip}`; |
| 8 | } |
Explanation (EN)
The framework resolves the address under an explicitly configured proxy trust policy; a missing address is not accepted as a new attacker-controlled identity.
Objašnjenje (HR)
Framework određuje adresu prema izričitoj politici povjerenja u proxyje; nedostajuća adresa ne postaje novi identitet koji kontrolira napadač.
Notes (EN)
Confirm whether each ingress overwrites or appends forwarding headers, whether the app can be reached directly, and whether route lengths vary. Trust only known proxies; use a fixed hop count only when every accepted route has the verified topology. Keep account/target limits and aggregate controls for costly unauthenticated operations. Configure a shared store when rate limits span replicas. Reference: https://expressjs.com/en/guide/behind-proxies/
Bilješke (HR)
Provjeri prepisuje li svaki ingress zaglavlja ili im dodaje unose, može li se aplikaciji pristupiti izravno i razlikuje li se broj proxyja po putanji. Vjeruj samo poznatim proxyjima; fiksni broj skokova koristi tek kada je topologija svih prihvaćenih putanja potvrđena. Za skupe javne operacije zadrži kvote po računu i ukupna ograničenja. Kod više replika koristi zajedničko spremište.
Exceptions / Tradeoffs (EN)
A gateway-supplied client-IP field is usable only when the gateway overwrites it and untrusted callers cannot bypass that gateway. IP limits alone are insufficient against distributed clients; this rule does not prescribe IPv6 bucket aggregation.
Iznimke / Tradeoffi (HR)
IP polje koje postavlja gateway može se koristiti samo kada ga gateway prepisuje i nepouzdani klijenti ne mogu zaobići taj gateway. Sam IP limit nije dovoljan protiv distribuiranih klijenata; ovo pravilo ne određuje grupiranje IPv6 adresa.