Rate limit bypass fix

Author: Commando-X

app.py

@@ -66,14 +66,56 @@ def cleanup_rate_limit_storage():
         if not rate_limit_storage[key]:
             del rate_limit_storage[key]
 
-def get_client_ip():
-    """Get client IP address, considering proxy headers"""
-    if request.headers.get('X-Forwarded-For'):
-        return request.headers.get('X-Forwarded-For').split(',')[0].strip()
-    elif request.headers.get('X-Real-IP'):
-        return request.headers.get('X-Real-IP')
-    else:
-        return request.remote_addr
+def is_valid_ip(ip):
+    """Validate IP address format"""
+    import ipaddress
+    try:
+        ipaddress.ip_address(ip)
+        return True
+    except ValueError:
+        return False
+
+def get_rate_limiting_identifiers():
+    """
+    Get multiple identifiers for rate limiting without requiring proxy knowledge
+    Uses defense-in-depth approach instead of perfect IP detection
+    """
+    import hashlib
+    
+    # 1. ALWAYS use the direct connection IP (most reliable)
+    remote_ip = request.remote_addr
+    identifiers = [f"direct_{remote_ip}"]
+    
+    # 2. If proxy headers exist, use them BUT with lower trust
+    forwarded_for = request.headers.get('X-Forwarded-For')
+    if forwarded_for:
+        # Take first IP from chain
+        client_ip = forwarded_for.split(',')[0].strip()
+        if is_valid_ip(client_ip) and client_ip != remote_ip:
+            identifiers.append(f"proxy_{client_ip}")
+    
+    real_ip = request.headers.get('X-Real-IP')
+    if real_ip and is_valid_ip(real_ip) and real_ip != remote_ip:
+        identifiers.append(f"realip_{real_ip}")
+    
+    # 3. Create a session-based identifier (harder to spoof)
+    user_agent = request.headers.get('User-Agent', '')[:100]  # Limit length
+    session_fingerprint = hashlib.md5(f"{remote_ip}:{user_agent}".encode()).hexdigest()[:12]
+    identifiers.append(f"session_{session_fingerprint}")
+    
+    return identifiers
+
+def enhanced_rate_limit_check(identifiers, limit):
+    """
+    Check rate limits across multiple identifiers
+    ANY identifier hitting the limit blocks the request
+    """
+    for identifier in identifiers:
+        allowed, count, _ = check_rate_limit(identifier, limit)
+        if not allowed:
+            return False, identifier, count, limit
+    
+    return True, None, 0, limit
 
 def check_rate_limit(key, limit):
     """Check if the request should be rate limited"""
@@ -129,6 +171,10 @@ def decorated_function(*args, **kwargs):
                         return jsonify({
                             'status': 'error',
                             'message': f'Rate limit exceeded for IP address. This IP has made {ip_count} requests in the last 3 hours. Limit is {ip_limit} requests per 3 hours.',
+                            'rate_limit_info': {
+                                'limit_type': 'authenticated_                        return jsonify({
+                            'status': 'error',
+                            'message': f'Rate limit exceeded for IP address. This IP has made {ip_count} requests in the last 3 hours. Limit is {ip_limit} requests per 3 hours.',
                             'rate_limit_info': {
                                 'limit_type': 'authenticated_ip',
                                 'current_count': ip_count,
@@ -1674,37 +1720,63 @@ def ai_system_info():
 def ai_rate_limit_status():
     """
     Check current rate limit status for AI endpoints
-    Useful for debugging and transparency
+    Now uses secure IP detection to prevent spoofing
     """
     try:
         cleanup_rate_limit_storage()
-        client_ip = get_client_ip()
+        ip_identifiers = get_multiple_ip_identifiers()
+        remote_ip = request.remote_addr
         current_time = time.time()
 
+        # Check for potential spoofing attempts
+        forwarded_for = request.headers.get('X-Forwarded-For')
+        real_ip = request.headers.get('X-Real-IP')
+        is_spoofing_attempt = (forwarded_for or real_ip) and not is_trusted_proxy(remote_ip, {
+            '127.0.0.1', '::1', '10.0.0.0/8', '172.16.0.0/12', '192.168.0.0/16'
+        })
+        
         status = {
             'status': 'success',
-            'client_ip': client_ip,
+            'security_info': {
+                'remote_ip': remote_ip,
+                'client_ips': ip_identifiers,
+                'spoofing_detected': is_spoofing_attempt,
+                'headers_checked': {
+                    'x_forwarded_for': forwarded_for,
+                    'x_real_ip': real_ip
+                } if is_spoofing_attempt else None
+            },
             'rate_limits': {
                 'unauthenticated': {
                     'limit': UNAUTHENTICATED_LIMIT,
                     'window_hours': 3,
-                    'requests_made': 0
+                    'requests_made': 0,
+                    'ip_breakdown': {}
                 },
                 'authenticated': {
                     'limit': AUTHENTICATED_LIMIT,
                     'window_hours': 3,
                     'user_requests_made': 0,
-                    'ip_requests_made': 0
+                    'ip_requests_made': 0,
+                    'ip_breakdown': {}
                 }
             }
         }
 
-        # Check unauthenticated rate limit
-        unauth_key = f"ai_unauth_ip_{client_ip}"
-        unauth_count = sum(count for timestamp, count in rate_limit_storage[unauth_key] 
-                          if timestamp > current_time - RATE_LIMIT_WINDOW)
-        status['rate_limits']['unauthenticated']['requests_made'] = unauth_count
-        status['rate_limits']['unauthenticated']['remaining'] = max(0, UNAUTHENTICATED_LIMIT - unauth_count)
+        # Check unauthenticated rate limits for all IP identifiers
+        total_unauth_requests = 0
+        for ip_addr in ip_identifiers:
+            unauth_key = f"ai_unauth_ip_{ip_addr}"
+            unauth_count = sum(count for timestamp, count in rate_limit_storage[unauth_key] 
+                              if timestamp > current_time - RATE_LIMIT_WINDOW)
+            total_unauth_requests += unauth_count
+            status['rate_limits']['unauthenticated']['ip_breakdown'][ip_addr] = {
+                'requests_made': unauth_count,
+                'remaining': max(0, UNAUTHENTICATED_LIMIT - unauth_count)
+            }
+        
+        status['rate_limits']['unauthenticated']['requests_made'] = total_unauth_requests
+        status['rate_limits']['unauthenticated']['remaining'] = max(0, UNAUTHENTICATED_LIMIT - total_unauth_requests)
 
         # Check if user is authenticated
         auth_header = request.headers.get('Authorization')
@@ -1713,19 +1785,27 @@ def ai_rate_limit_status():
             try:
                 user_data = verify_token(token)
                 if user_data:
-                    # Check authenticated rate limits
                     user_key = f"ai_auth_user_{user_data['user_id']}"
-                    ip_key = f"ai_auth_ip_{client_ip}"
 
                     user_count = sum(count for timestamp, count in rate_limit_storage[user_key] 
                                    if timestamp > current_time - RATE_LIMIT_WINDOW)
-                    ip_count = sum(count for timestamp, count in rate_limit_storage[ip_key] 
-                                 if timestamp > current_time - RATE_LIMIT_WINDOW)
+                    
+                    # Check IP-based limits for all identifiers
+                    total_auth_ip_requests = 0
+                    for ip_addr in ip_identifiers:
+                        ip_key = f"ai_auth_ip_{ip_addr}"
+                        ip_count = sum(count for timestamp, count in rate_limit_storage[ip_key] 
+                                     if timestamp > current_time - RATE_LIMIT_WINDOW)
+                        total_auth_ip_requests += ip_count
+                        status['rate_limits']['authenticated']['ip_breakdown'][ip_addr] = {
+                            'requests_made': ip_count,
+                            'remaining': max(0, AUTHENTICATED_LIMIT - ip_count)
+                        }
 
                     status['rate_limits']['authenticated']['user_requests_made'] = user_count
-                    status['rate_limits']['authenticated']['ip_requests_made'] = ip_count
+                    status['rate_limits']['authenticated']['ip_requests_made'] = total_auth_ip_requests
                     status['rate_limits']['authenticated']['user_remaining'] = max(0, AUTHENTICATED_LIMIT - user_count)
-                    status['rate_limits']['authenticated']['ip_remaining'] = max(0, AUTHENTICATED_LIMIT - ip_count)
+                    status['rate_limits']['authenticated']['ip_remaining'] = max(0, AUTHENTICATED_LIMIT - total_auth_ip_requests)
                     status['authenticated_user'] = {
                         'user_id': user_data['user_id'],
                         'username': user_data['username']