[middleware] tests: ThrottleMiddleware x-forwarded-for test passes for the wrong reason

[rudderjs]

Filed by the auto-audit routine. Dimension: tests. Severity: medium.

What

The test at packages/middleware/src/index.test.ts:372 is titled "uses x-forwarded-for header for client key", but ThrottleMiddleware.handle() calls clientIp(req) (line 186 of index.ts) which reads only req.ip - not the x-forwarded-for header. The test constructs a request via makeReq({ headers: { 'x-forwarded-for': '10.0.0.1, 192.168.1.1' } }) which inherits the makeReq default of ip: '127.0.0.1'. Both calls in the test use the same req.ip (127.0.0.1), so the second call is blocked - but because of the IP default, not because of the forwarded-for header. The x-forwarded-for header is completely ignored.

Where

packages/middleware/src/index.test.ts:372 (test case "uses x-forwarded-for header for client key")

Why it matters

The test gives false confidence that ThrottleMiddleware processes the x-forwarded-for header for rate-limit keying. It does not: IP resolution is fully delegated to server-hono's extractIp(), which sets req.ip. A developer reading the test might believe raw header processing is tested when it is not. If someone later modifies clientIp() to read raw headers directly (bypassing the server adapter's trusted-proxy logic), no existing test would catch the regression.

Suggested direction

Rename or replace the test. The correct behavior to document is: "ThrottleMiddleware keys by req.ip, which is set by the server adapter (server-hono's extractIp()), not by the middleware itself." One correct test: when req.ip is explicitly absent, all requests key to 'unknown' and share one bucket (already partially covered by the "warns once" test). Another: when two requests have different req.ip values, they use separate buckets.

---

_{audit:auto - package @rudderjs/middleware - cycle 2026-06-23}