Repair rate limiter's IP getter

[steveluscher]

The rate limiter middleware's default key is req.ip but there doesn't appear to be a property called ip on the request that we pass to it here. The actual object we give it is an IncomingMessage and the IP is available as socket.remoteAddress or in the headers.

In this PR, we teach the rate limiter middleware to source the IP address from the x-real-ip header first, and the remoteAddress on the socket second.

[jordaaash]

source the IP address from the x-real-ip header first

Doesn't this mean a client could lie about its IP by passing this?

[steveluscher]

I don't think so. Spoof protection is really up to the proxy. When Octane is launched on Vercel, for instance, Vercel itself protects against IP spoofing.

The public IP address of the client that made the request. If you are trying to use Vercel behind a proxy, we currently overwrite the X-Forwarded-For header and do not forward external IPs. This restriction is in place to prevent IP spoofing.

https://vercel.com/docs/concepts/edge-network/headers#x-forwarded-for

[jordaaash]

Thanks!