A limit keyed on a client header

Labs need a computer

Open this page on a computer, or make the browser window larger.

Loading the lab.

Scenario

Now there is a five-attempt limit, but the server counts attempts by the IP in the X-Forwarded-For header, which the client sends. Change it each request and you get a fresh counter, so the limit never bites.

What you are looking at

The same verify screen, but the server limits attempts by X-Forwarded-For. That header is client-controlled, so rotating it grants a fresh counter each time.

Goal

Bypass the limit by rotating the IP header and guess the code.

What counts as solved

You rotated the header, bypassed the limit and guessed the code.

Method checklist

Tick each step as you work through it. The steps are the method, not the answer.

Try several attempts with the same header and note the block.
Note the key is a header the client sends.
Change the header to a new address.
Repeat with different addresses until you guess the code.

Hints

You have not revealed a hint yet. Ask the falcon when you need one.

Why the solution worked

The limit key was a client-controlled header, so it is worthless because the attacker forges it. The rule is that the limit key must be something the client does not control, like the account or the server-trusted network address.

The root cause

The limit key is a client-controlled header. The root is trusting a client value to pick the rate bucket.

How the code is fixed

Key the limit on something the client cannot control: the account or the trusted peer address.

Vulnerable code

const key = req.headers['x-forwarded-for'] || 'default'; // client-controlled

Safe code

const key = req.user?.id ?? req.socket.remoteAddress; // account, or the real peer address

Impact in the real world

Forging the IP header bypasses rate limits in many systems and reopens guessing and flooding.

How defenders detect it

Defenders count by account or the server-trusted network address and alert on many IP-header values from one source.

Next level Back to the lesson