fix(security): key per-IP rate limits on the proxy-written forwarded hop

getClientIp derived the client IP from the leftmost X-Forwarded-For entry.
Under any proxy that appends to that header — nginx-ingress, HAProxy,
Cloudflare, and both reference deployments in this repo — the leftmost entry
is supplied by the caller, so rotating it minted a fresh token bucket per
request and every per-IP throttle became a no-op: the contact and demo-request
mailers, telemetry, the docs Ask-AI endpoint, and public-deployment password
attempts.

The repo already treated that hop as untrusted for Better Auth via
AUTH_TRUSTED_PROXIES; Sim's own helper never consulted it. packages/audit
carried a second copy of the same function, forging audit-row IPs.

Resolve the chain right to left instead, skipping configured trusted hops and
returning the first untrusted address — the closest hop the infrastructure
actually vouched for. Shared from @sim/security/client-ip so the app, the docs
app, and the audit package cannot drift again.

- fall back to the rightmost hop, never the leftmost, when every hop is
  trusted, so forging an address inside a broad configured range (the docs
  recommend 10.0.0.0/16) cannot reinstate the bypass
- strip IPv6 zone ids, which ipaddr accepts at arbitrary length and would
  otherwise hand a caller unlimited distinct bucket keys
- canonicalize addresses so equivalent spellings share one bucket
- bound consecutive failed password guesses per deployment, not just per IP,
  since a distributed caller gets a fresh IP bucket per source

The generic webhook allowlist keeps leftmost semantics via getAssertedOriginIp:
it names the sending service, not the proxy, so resolving it like a throttle key
would have 403'd every allowlisted delivery. Both sides are now canonicalized.

Operators behind a multi-hop chain should set AUTH_TRUSTED_PROXIES to their real
hops; unset is safe but collapses callers onto the edge address.

Author: waleedlatif1

apps/docs/app/api/chat/route.ts

@@ -1,4 +1,5 @@
 import { openai } from '@ai-sdk/openai'
+import { parseTrustedProxies, resolveClientIp } from '@sim/security/client-ip'
 import {
   convertToModelMessages,
   jsonSchema,
@@ -69,11 +70,21 @@ const RATE_LIMIT_MAX = 20
 const RATE_LIMIT_WINDOW_MS = 60_000
 const rateLimitHits = new Map<string, { count: number; resetAt: number }>()
 
-/** Resolve the client IP from forwarding headers, falling back to a shared bucket. */
+/**
+ * Reverse-proxy hops trusted for forwarded-IP resolution — the same
+ * `AUTH_TRUSTED_PROXIES` the main app reads. Parsed once at module load.
+ */
+const trustedProxies = parseTrustedProxies(process.env.AUTH_TRUSTED_PROXIES)
+
+/**
+ * Resolve the client IP from forwarding headers, falling back to a shared
+ * bucket. Walks the chain right to left: the leftmost `X-Forwarded-For` entry is
+ * caller-supplied, so keying this limit on it would let anyone rotate the header
+ * to mint a fresh bucket per request — and, on this endpoint, unmetered model
+ * spend plus unbounded growth of `rateLimitHits`. See {@link resolveClientIp}.
+ */
 function getClientIp(req: Request): string {
-  const forwarded = req.headers.get('x-forwarded-for')
-  if (forwarded) return forwarded.split(',')[0].trim()
-  return req.headers.get('x-real-ip') ?? 'unknown'
+  return resolveClientIp(req, trustedProxies)
 }
 
 /** Fixed-window check. Returns retry-after seconds when the caller is over the limit, else null. */

apps/docs/package.json

@@ -21,6 +21,7 @@
     "@ai-sdk/react": "2.0.205",
     "@sim/db": "workspace:*",
     "@sim/emcn": "workspace:*",
+    "@sim/security": "workspace:*",
     "@sim/workflow-renderer": "workspace:*",
     "ai": "5.0.203",
     "class-variance-authority": "^0.7.1",

apps/sim/.env.example

@@ -19,7 +19,7 @@ BETTER_AUTH_URL=http://localhost:3000
 NEXT_PUBLIC_APP_URL=http://localhost:3000
 # INTERNAL_API_BASE_URL=http://sim-app.default.svc.cluster.local:3000  # Optional: internal URL for server-side /api self-calls; defaults to NEXT_PUBLIC_APP_URL
 # TRUSTED_ORIGINS=https://www.example.com,https://app.example.com  # Optional: comma-separated additional public origins to trust for auth (apex+www, alias domains). Merged into Better Auth trustedOrigins.
-# AUTH_TRUSTED_PROXIES=10.0.0.0/24,192.0.2.10  # Optional: reverse-proxy IPs/CIDRs in front of the app. Better Auth walks x-forwarded-for right to left, skips these hops, and uses the first untrusted address as the client IP (prevents forwarded-header spoofing). Use your proxies' actual addresses, not broad private ranges that also cover clients.
+# AUTH_TRUSTED_PROXIES=10.0.0.0/24,192.0.2.10  # Optional: reverse-proxy IPs/CIDRs in front of the app. Better Auth and Sim's own per-IP throttles walk x-forwarded-for right to left, skip these hops, and use the first untrusted address as the client IP (the leftmost entry is caller-supplied and would otherwise let anyone mint a fresh rate-limit bucket per request). Unset trusts no hop and keys on the rightmost entry — safe, but a multi-hop chain collapses callers onto the edge addresses. Use your proxies' actual addresses, not broad private ranges that also cover clients.
 
 # Chat (Optional)
 # COPILOT_API_KEY=                      # Mint one at https://sim.ai. Without it the Sim Chat block, prompt jobs, and Inbox cannot run

apps/sim/app/api/chat/[identifier]/otp/route.ts

@@ -19,7 +19,8 @@ import {
   OTP_IP_RATE_LIMIT,
   storeOTP,
 } from '@/lib/core/security/otp'
-import { generateRequestId, getClientIp } from '@/lib/core/utils/request'
+import { getClientIp } from '@/lib/core/utils/client-ip'
+import { generateRequestId } from '@/lib/core/utils/request'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { sendEmail } from '@/lib/messaging/email/mailer'
 import { setChatAuthCookie } from '@/app/api/chat/utils'

apps/sim/app/api/chat/[identifier]/sso/route.ts

@@ -8,7 +8,8 @@ import { parseRequest } from '@/lib/api/server'
 import type { TokenBucketConfig } from '@/lib/core/rate-limiter'
 import { RateLimiter } from '@/lib/core/rate-limiter'
 import { isEmailAllowed } from '@/lib/core/security/deployment'
-import { generateRequestId, getClientIp } from '@/lib/core/utils/request'
+import { getClientIp } from '@/lib/core/utils/client-ip'
+import { generateRequestId } from '@/lib/core/utils/request'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { createErrorResponse, createSuccessResponse } from '@/app/api/workflows/utils'
 

apps/sim/app/api/chat/utils.test.ts

@@ -20,18 +20,21 @@ const {
   mockSetDeploymentAuthCookie,
   mockIsEmailAllowed,
   mockCheckRateLimitDirect,
+  mockResetRateLimitBucket,
 } = vi.hoisted(() => ({
   mockMergeSubblockStateWithValues: vi.fn().mockReturnValue({}),
   mockMergeSubBlockValues: vi.fn().mockReturnValue({}),
   mockValidateAuthToken: vi.fn().mockReturnValue(false),
   mockSetDeploymentAuthCookie: vi.fn(),
   mockIsEmailAllowed: vi.fn(),
   mockCheckRateLimitDirect: vi.fn().mockResolvedValue({ allowed: true }),
+  mockResetRateLimitBucket: vi.fn().mockResolvedValue(undefined),
 }))
 
 vi.mock('@/lib/core/rate-limiter', () => ({
   RateLimiter: class {
     checkRateLimitDirect = mockCheckRateLimitDirect
+    resetRateLimitBucket = mockResetRateLimitBucket
   },
 }))
 
@@ -212,6 +215,74 @@ describe('Chat API Utils', () => {
       expect(result.authorized).toBe(true)
     })
 
+    it('clears the per-resource failure counter once a password verifies', async () => {
+      const deployment = {
+        id: 'chat-id',
+        authType: 'password',
+        password: 'encrypted-password',
+      }
+
+      const mockRequest = {
+        method: 'POST',
+        cookies: { get: vi.fn().mockReturnValue(null) },
+      } as any
+
+      await validateChatAuth('request-id', deployment, mockRequest, {
+        password: 'correct-password',
+      })
+
+      expect(mockResetRateLimitBucket).toHaveBeenCalledWith('chat-password:resource:chat-id')
+    })
+
+    it('leaves the per-resource failure counter consumed when the password is wrong', async () => {
+      const deployment = {
+        id: 'chat-id',
+        authType: 'password',
+        password: 'encrypted-password',
+      }
+
+      const mockRequest = {
+        method: 'POST',
+        cookies: { get: vi.fn().mockReturnValue(null) },
+      } as any
+
+      const result = await validateChatAuth('request-id', deployment, mockRequest, {
+        password: 'wrong-password',
+      })
+
+      expect(result.authorized).toBe(false)
+      expect(mockCheckRateLimitDirect).toHaveBeenCalledWith(
+        'chat-password:resource:chat-id',
+        expect.objectContaining({ maxTokens: 500 })
+      )
+      expect(mockResetRateLimitBucket).not.toHaveBeenCalled()
+    })
+
+    it('rejects guesses once the per-resource counter is exhausted, without decrypting', async () => {
+      const deployment = {
+        id: 'chat-id',
+        authType: 'password',
+        password: 'encrypted-password',
+      }
+
+      const mockRequest = {
+        method: 'POST',
+        cookies: { get: vi.fn().mockReturnValue(null) },
+      } as any
+
+      mockCheckRateLimitDirect.mockImplementation(async (key: string) =>
+        key.includes(':resource:') ? { allowed: false, retryAfterMs: 900_000 } : { allowed: true }
+      )
+
+      const result = await validateChatAuth('request-id', deployment, mockRequest, {
+        password: 'guess',
+      })
+
+      expect(result.authorized).toBe(false)
+      expect(result.status).toBe(429)
+      expect(decryptSecret).not.toHaveBeenCalled()
+    })
+
     it('should reject incorrect password', async () => {
       const deployment = {
         id: 'chat-id',

apps/sim/app/api/contact/route.ts

@@ -11,7 +11,8 @@ import { env } from '@/lib/core/config/env'
 import type { TokenBucketConfig } from '@/lib/core/rate-limiter'
 import { RateLimiter } from '@/lib/core/rate-limiter'
 import { isTurnstileConfigured, verifyTurnstileToken } from '@/lib/core/security/turnstile'
-import { generateRequestId, getClientIp } from '@/lib/core/utils/request'
+import { getClientIp } from '@/lib/core/utils/client-ip'
+import { generateRequestId } from '@/lib/core/utils/request'
 import { getEmailDomain } from '@/lib/core/utils/urls'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { sendEmail } from '@/lib/messaging/email/mailer'

apps/sim/app/api/demo-requests/route.ts

@@ -8,7 +8,8 @@ import { parseRequest } from '@/lib/api/server'
 import { env } from '@/lib/core/config/env'
 import type { TokenBucketConfig } from '@/lib/core/rate-limiter'
 import { RateLimiter } from '@/lib/core/rate-limiter'
-import { generateRequestId, getClientIp } from '@/lib/core/utils/request'
+import { getClientIp } from '@/lib/core/utils/client-ip'
+import { generateRequestId } from '@/lib/core/utils/request'
 import { getEmailDomain } from '@/lib/core/utils/urls'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { sendEmail } from '@/lib/messaging/email/mailer'

apps/sim/app/api/files/public/[token]/otp/route.ts

@@ -21,7 +21,8 @@ import {
   OTP_IP_RATE_LIMIT,
   storeOTP,
 } from '@/lib/core/security/otp'
-import { generateRequestId, getClientIp } from '@/lib/core/utils/request'
+import { getClientIp } from '@/lib/core/utils/client-ip'
+import { generateRequestId } from '@/lib/core/utils/request'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { sendEmail } from '@/lib/messaging/email/mailer'
 import { resolveActiveShareByToken } from '@/lib/public-shares/share-manager'

apps/sim/app/api/files/public/[token]/sso/route.ts

@@ -7,7 +7,8 @@ import { parseRequest } from '@/lib/api/server'
 import type { TokenBucketConfig } from '@/lib/core/rate-limiter'
 import { RateLimiter } from '@/lib/core/rate-limiter'
 import { isEmailAllowed } from '@/lib/core/security/deployment'
-import { generateRequestId, getClientIp } from '@/lib/core/utils/request'
+import { getClientIp } from '@/lib/core/utils/client-ip'
+import { generateRequestId } from '@/lib/core/utils/request'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { resolveActiveShareByToken } from '@/lib/public-shares/share-manager'