The Spoofed Header Rate Limiter Bypass

"""
Proxy Middleware - Client IP Resolver
Resolves client remote IP from incoming HTTP headers and network peer address.
"""

class ProxyMiddleware:
    def __init__(self, trusted_hops=1):
        self.trusted_hops = trusted_hops

    def resolve_client_ip(self, headers, peer_ip):
        # AI Attempt: Extract client IP from X-Forwarded-For
        # BUG: Blindly parses leftmost entry! An attacker who sends
        # 'X-Forwarded-For: 1.2.3.4, 198.51.100.77' can spoof any arbitrary IP!
        xff = headers.get("X-Forwarded-For")
        if xff:
            parts = [p.strip() for p in xff.split(",") if p.strip()]
            if parts:
                return parts[0]
        return peer_ip