From ca20431d84703e74205efa80ca8a4b9fabd24141 Mon Sep 17 00:00:00 2001
From: ajnart <thomas@ajnart.dev>
Date: Thu, 20 Aug 2026 14:48:02 +0200
Subject: [PATCH] fix: address final review findings

---
 apps/nextjs/src/app/api/backup/test/import-route.spec.ts | 2 +-
 packages/common/src/request.ts                           | 8 +++++++-
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/apps/nextjs/src/app/api/backup/test/import-route.spec.ts b/apps/nextjs/src/app/api/backup/test/import-route.spec.ts
index a08ac3f54..062d8db95 100644
--- a/apps/nextjs/src/app/api/backup/test/import-route.spec.ts
+++ b/apps/nextjs/src/app/api/backup/test/import-route.spec.ts
@@ -101,7 +101,7 @@ describe("POST /api/backup/import", () => {
   let activeDatabasePath: string;
 
   beforeEach(() => {
-    vi.useFakeTimers();
+    vi.useFakeTimers({ toFake: ["setTimeout", "clearTimeout"] });
     temporaryDirectory = fs.mkdtempSync(path.join(os.tmpdir(), "homarr-import-route-test-"));
     activeDatabasePath = path.join(temporaryDirectory, "db.sqlite");
     routeMocks.dbEnv.DRIVER = "better-sqlite3";
diff --git a/packages/common/src/request.ts b/packages/common/src/request.ts
index f90d91945..92e802501 100644
--- a/packages/common/src/request.ts
+++ b/packages/common/src/request.ts
@@ -11,5 +11,11 @@ export const userAgent = (headers: Headers) => {
 export type DeviceType = "console" | "mobile" | "tablet" | "smarttv" | "wearable" | "embedded" | undefined;
 
 export const ipAddressFromHeaders = (headers: Headers): string | null => {
-  return headers.get("x-forwarded-for");
+  const forwardedFor = headers.get("x-forwarded-for");
+  if (!forwardedFor) return null;
+
+  // The bundled nginx proxy appends the transport peer to this chain. Using
+  // the last hop prevents a caller-controlled prefix from creating arbitrary
+  // rate-limit identities.
+  return forwardedFor.split(",").at(-1)?.trim() || null;
 };