From 2ba6425eed2ff75f3cea6de920570ffe402a6435 Mon Sep 17 00:00:00 2001
From: Deep Koluguri <deepkoluguri@gmail.com>
Date: Mon, 22 Jun 2026 22:03:32 -0400
Subject: [PATCH] fix: trust proxy for express-rate-limit to prevent crash
 behind APISIX

---
 backend/src/middleware/security.js | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/backend/src/middleware/security.js b/backend/src/middleware/security.js
index 8aaf010..64560e0 100644
--- a/backend/src/middleware/security.js
+++ b/backend/src/middleware/security.js
@@ -3,6 +3,9 @@ import helmet from 'helmet';
 import cors from 'cors';
 
 export const setupSecurity = (app) => {
+  // Trust proxy for express-rate-limit behind Kubernetes Ingress
+  app.set('trust proxy', 1);
+
   // Helmet for security headers
   app.use(helmet({
     contentSecurityPolicy: {