From a9e50bb598f5436cc59899ab2ab1f95351157bd8 Mon Sep 17 00:00:00 2001
From: qing <1776177662@qq.com>
Date: Sat, 25 Jul 2026 10:21:51 +0800
Subject: [PATCH] =?UTF-8?q?=E4=BF=AE=20proxy.go=20=E9=87=8C=20Director=20?=
 =?UTF-8?q?=E7=9A=84=20X-Forwarded-For=20=E5=B8=A6=E7=AB=AF=E5=8F=A3?=
 =?UTF-8?q?=E5=8F=B7=E9=97=AE=E9=A2=98=E3=80=82ServeHTTP=20=E9=87=8C?=
 =?UTF-8?q?=E5=B7=B2=E7=BB=8F=E6=9C=89=E5=89=A5=E7=A6=BB=E7=AB=AF=E5=8F=A3?=
 =?UTF-8?q?=E7=9A=84=E9=80=BB=E8=BE=91=EF=BC=8CDirector=20=E9=87=8C?=
 =?UTF-8?q?=E5=A4=8D=E7=94=A8=E5=90=8C=E6=A0=B7=E7=9A=84=E5=A4=84=E7=90=86?=
 =?UTF-8?q?=E5=B0=B1=E8=A1=8C=E3=80=82?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 waf/internal/proxy/proxy.go | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/waf/internal/proxy/proxy.go b/waf/internal/proxy/proxy.go
index 66e549d..30f5cff 100644
--- a/waf/internal/proxy/proxy.go
+++ b/waf/internal/proxy/proxy.go
@@ -35,7 +35,13 @@ func New(upstream string, waf *engine.Engine) (*Proxy, error) {
 	origDirector := rp.Director
 	rp.Director = func(req *http.Request) {
 		origDirector(req)
-		req.Header.Set("X-Forwarded-For", req.RemoteAddr)
+		// RemoteAddr 形如 "1.2.3.4:54321"，剥离端口只保留 IP，
+		// 否则 gateway RateLimiter 会把同 IP 不同端口的连接当成不同客户端
+		clientIP := req.RemoteAddr
+		if idx := strings.LastIndexByte(req.RemoteAddr, ':'); idx != -1 {
+			clientIP = req.RemoteAddr[:idx]
+		}
+		req.Header.Set("X-Forwarded-For", clientIP)
 		req.Header.Set("X-Forwarded-Proto", "https")
 	}
 	// 透传错误，不暴露内部堆栈