Why does my login rate limit fail with X-Forwarded-For?

X-Forwarded-For is a header the client can send, so anyone can put any value in it. Your limiter is counting attempts per value of that header, and an attacker simply changes it on every request, so they never reach 10.

The fix is to read an address the client can't control. If nginx is the only thing in front of your app, set X-Real-IP in the proxy block:

proxy_set_header X-Real-IP $remote_addr;

and have the app read X-Real-IP instead. $remote_addr is the address of whoever actually connected to nginx, which can't be forged by a header. Then test it: send 11 attempts with a different fake X-Forwarded-For each time, and the 11th should still be blocked.

That worked, thanks. The fake header no longer gets around it and it blocks on attempt 11. Should the same change go anywhere else?

Anywhere you use the visitor's IP for something that matters: vote or like counters, contact form logs, free-tier limits, abuse reports. Search your code for x-forwarded-for and check each one. If you're behind Cloudflare or another CDN as well, you'd use their trusted header instead, but only when requests are guaranteed to come through them.

Our Security Audit includes an active rate-limit test on your login page if you want to confirm it from outside.