fix(api/models): prevent rate-limit bypass via header spoofing with IP validation

Author: tembo[bot]

apps/web/src/routes/api/models.ts

@@ -9,8 +9,23 @@ const OPENROUTER_MODELS_URL = "https://openrouter.ai/api/v1/models";
 const OPENROUTER_FETCH_TIMEOUT_MS = 10_000;
 const TRUST_PROXY_MODE = process.env.TRUST_PROXY?.trim().toLowerCase();
 
+/**
+ * Basic IPv4/IPv6 format validation.
+ * Rejects obviously spoofed or malformed values used in x-forwarded-for.
+ */
+const IPV4_REGEX = /^(\d{1,3}\.){3}\d{1,3}$/;
+const IPV6_REGEX = /^[0-9a-fA-F:]+$/;
+
+function isValidIpFormat(ip: string): boolean {
+	return IPV4_REGEX.test(ip) || IPV6_REGEX.test(ip);
+}
+
 if (TRUST_PROXY_MODE === "true") {
-	console.warn("[Models API] TRUST_PROXY=true requires x-forwarded-for for rate limiting");
+	console.warn(
+		"[Models API] TRUST_PROXY=true uses x-forwarded-for for rate limiting. " +
+		"This is INSECURE unless the app is behind a trusted reverse proxy that overwrites x-forwarded-for. " +
+		"Prefer TRUST_PROXY=cloudflare or TRUST_PROXY=vercel for production deployments.",
+	);
 }
 
 if (!TRUST_PROXY_MODE) {
@@ -82,23 +97,40 @@ function getClientIp(request: Request): string | null {
 
 	if (TRUST_PROXY_MODE === "cloudflare") {
 		const cfConnectingIp = request.headers.get("cf-connecting-ip")?.trim();
-		return cfConnectingIp || null;
+		if (cfConnectingIp && isValidIpFormat(cfConnectingIp)) return cfConnectingIp;
+		return null;
 	}
 
 	if (TRUST_PROXY_MODE === "vercel") {
 		const vercelForwardedFor = request.headers.get("x-vercel-forwarded-for")?.trim();
 		if (vercelForwardedFor) {
 			const first = vercelForwardedFor.split(",")[0]?.trim();
-			if (first) return first;
+			if (first && isValidIpFormat(first)) return first;
 		}
 		return null;
 	}
 
 	if (TRUST_PROXY_MODE === "true") {
+		// Prefer platform-specific headers that are harder to spoof, as they
+		// are typically set/overwritten by the edge proxy itself.
+		const cfIp = request.headers.get("cf-connecting-ip")?.trim();
+		if (cfIp && isValidIpFormat(cfIp)) return cfIp;
+
+		const vercelIp = request.headers.get("x-vercel-forwarded-for")?.trim();
+		if (vercelIp) {
+			const first = vercelIp.split(",")[0]?.trim();
+			if (first && isValidIpFormat(first)) return first;
+		}
+
+		const realIp = request.headers.get("x-real-ip")?.trim();
+		if (realIp && isValidIpFormat(realIp)) return realIp;
+
+		// Fall back to x-forwarded-for only as last resort, with IP validation.
+		// WARNING: This header is user-controlled unless the proxy overwrites it.
 		const forwardedFor = request.headers.get("x-forwarded-for")?.trim();
 		if (forwardedFor) {
 			const first = forwardedFor.split(",")[0]?.trim();
-			if (first) return first;
+			if (first && isValidIpFormat(first)) return first;
 		}
 		return null;
 	}