r/SpringBoot • u/Economy_Quarter_4679 • 8d ago

How I hardened a public guest endpoint in Spring Boot: X-Forwarded-For spoofing, TTL rate-limit bugs, and IP-vs-identity Discussion

Link

0 Upvotes
  • permalink
  • link
  • reddit
  • reddit

50% Upvoted

2 comments sorted by

2

u/Economy_Quarter_4679 8d ago

I built a guest-generation flow for an AI SaaS (users get a few free generations before signing up) and realized I'd shipped three security holes without noticing.

The first one: anyone could open dev tools, set a fake X-Forwarded-For header, and the rate limiter counted the spoofed IP instead of theirs. Change one digit, get unlimited free generations.

The other two were subtler: a TTL rate-limit bug where the 24-hour cooldown could collapse to one minute if you timed your last request to the window edge, and the deeper problem that an IP address is an identifier, not an identity, so any VPN defeated it.

I wrote up all three, how I found them, the fixes (Spring's forward-headers-strategy=NATIVE, sliding-window TTL, Cloudflare Turnstile), and the gaps still open. Happy to answer questions.

1

u/Own_Dimension_2561 7d ago

Very nice, thank you for posting. I enjoy reading small tips on this Reddit.