Open
Description
What type of issue is it? (Choose one - delete the others)
Discussion
What article/section is this about?
Describe the issue
When implementing API rate limiting as described here, the default setup relies on IP-based limiting via IpRateLimiting. However, in many production environments, Umbraco is hosted behind a Web Application Firewall (WAF) or reverse proxy (such as Cloudflare, Azure Front Door, NGINX, etc.). In these cases, the client IP address is typically replaced by the proxy’s IP, causing the rate limiting to apply to the WAF instead of the actual user.
Suggestion:
It would be helpful if the documentation included a clear note that:
When running Umbraco behind a WAF or reverse proxy, it's necessary to configure the RealIpHeader setting in appsettings.json to correctly extract the original client IP.
Somthing like:
"IpRateLimiting": {
"RealIpHeader": "X-Forwarded-For",
"HttpStatusCode": 429,
...
}