security: prioritize request.ip over x-forwarded-for to prevent IP spoofing [#4]

Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>

app/api/auth/route.ts

@@ -12,7 +12,12 @@ const AUTH_RPM = 10;
 
 export async function POST(request: NextRequest) {
   // ── Rate limiting (brute-force protection) ──────────
-  const ip = request.headers.get('x-forwarded-for')?.split(',')[0].trim() || 'unknown';
+  // Security: Prioritize request.ip and x-real-ip to prevent x-forwarded-for spoofing
+  const ip =
+    request.ip ??
+    request.headers.get('x-real-ip') ??
+    request.headers.get('x-forwarded-for')?.split(',')[0].trim() ??
+    'unknown';
   const { success } = checkRateLimit(`auth:${ip}`, AUTH_RPM);
 
   if (!success) {

app/api/image/[id]/route.ts

@@ -26,7 +26,12 @@ function widthToSize(w: number): ImageSize {
 
 export async function GET(request: NextRequest, { params }: { params: Promise<{ id: string }> }) {
   // ── Rate limiting ──────────────────────────────────
-  const ip = request.headers.get('x-forwarded-for')?.split(',')[0].trim() || 'unknown';
+  // Security: Prioritize request.ip and x-real-ip to prevent x-forwarded-for spoofing
+  const ip =
+    request.ip ??
+    request.headers.get('x-real-ip') ??
+    request.headers.get('x-forwarded-for')?.split(',')[0].trim() ??
+    'unknown';
   const { success, remaining, resetAt } = checkRateLimit(ip, getConfig().rateLimitRpm);
 
   if (!success) {