Fix: Prevent Rate Limit Bypass via Header Spoofing

[riddhima25bet10005-a11y]

Description

Fixes a security vulnerability in the rate limiter (\middleware.tsx) where the \X-Forwarded-For\ header was blindly trusted as the rate limit key. Since this header is client-controlled, it could be spoofed to bypass rate limits (Issue #270).

The middleware now attempts to use the authenticated \userId\ as the primary rate limit key. For unauthenticated requests, it falls back to
eq.ip\ (which is securely populated by hosting platforms like Vercel and cannot be spoofed by the client), before falling back to the headers.

Fixes #270

Changes Made

• Updated \middleware.tsx\ to extract \userId\ from \�uth()\ for rate limiting
• Updated fallback IP resolution to prioritize
  eq.ip\ over \X-Forwarded-For\

Checklist

• I have tested my changes locally
• I have followed the GSSoC '26 contribution guidelines
• The code is clean and well-documented

[vercel]

@riddhima25bet10005-a11y is attempting to deploy a commit to the Karan Mani Tripathi 's projects Team on Vercel.

A member of the Team first needs to authorize it.

[riddhima25bet10005-a11y]

Hey @knoxiboy
Kindly review and approve.

[riddhima25bet10005-a11y]

@knoxiboy reviewed?