Zen rate limiting sees the wrong IP on DigitalOcean; it reads do-connecting-ip, not x-forwarded-for

TL;DR: If you run Zen behind DigitalOcean App Platform and IP-based features misbehave, upgrade past 1.7.11 and set the proxy header config. Fixed in @aikidosec/firewall 1.7.11, which added support for do-connecting-ip

Fix

1. If you run Zen behind DigitalOcean App Platform and IP-based features misbehave, upgrade past 1.7.11 and set the proxy header config. Expected: this specific failure stops.

2. Broader lesson: whenever IP-based rate limiting or blocking acts on the wrong address, check what your platform actually sends. Expected: this specific failure stops.

Details

Fixed in @aikidosec/firewall 1.7.11, which added support for do-connecting-ip as the client IP source, configured via an environment variable (see docs/proxy.md in the repo). Cloudflare uses CF-Connecting-IP, AWS ALB appends to X-Forwarded-For, and DO uses do-connecting-ip. Zen's proxy docs list the supported headers.

When to use

You hit exactly this: Zen rate limiting sees the wrong IP on DigitalOcean; it reads do-connecting-ip, not x-forwarded-for in Zen.

When not to use

A different error, or the same symptom in a different tool. This page only covers the failure above.

Compatibility

Zen (versions mentioned here: 1.7.11).

Asked in GitHub issue gh:AikidoSec/firewall-node#696: Issue AikidoSec/firewall-node#696 (closed, 3 comments): on DigitalOcean App Platform, Zen's rate limiting and IP-based blocking used the wrong client IP, because DO does not put the client IP in x-forwarded-for the usual way. DO sends the client IP in the do-connecting-ip header and uses x-forwarded-for for the ingress server IP. The verified fix/answer: Fixed in @aikidosec/firewall 1.7.11, which added support for do-connecting-ip as the client IP source, configured via an environment variable (see docs/proxy.md in the repo). If you run Zen behind DigitalOcean App Platform and IP-based features misbehave, upgrade past 1.7.11 and set the proxy header config. Broader lesson: whenever IP-based rate limiting or blocking acts on the wrong address, check what your platform actually sends. Cloudflare uses CF-Connecting-IP, AWS ALB appends to X-Forwarded-For, and DO uses do-connecting-ip. Zen's proxy docs list the supported headers. Source: https://github.com/AikidoSec/firewall-node/issues/696