Your rate limiter is broken behind a tunnel — the X-Forwarded-For problem

You put your app behind a tunnel (or any reverse proxy) to test webhooks. Everything works. Then you notice something odd in your logs: every single request comes from the same IP address. Congratulat...