fix: identify visitors by the proxy-added X-Forwarded-For entry (spoofing confirmed)

app.py

@@ -181,8 +181,11 @@ class VisitorQuota:
         self._counts: dict[str, int] = {}
 
     def visitor(self, request: Request) -> str:
-        forwarded = request.headers.get("x-forwarded-for", "")
-        ip = forwarded.split(",")[0].strip() or (request.client.host if request.client else "unknown")
+        # HF's proxy appends the real client address to any X-Forwarded-For the client sent,
+        # so the left-most entry is client-controlled (verified: a fake one dodged the limit).
+        # Use the right-most entry, the one the proxy added.
+        forwarded = [part.strip() for part in request.headers.get("x-forwarded-for", "").split(",") if part.strip()]
+        ip = forwarded[-1] if forwarded else (request.client.host if request.client else "unknown")
         return hmac.new(self._key, ip.encode(), hashlib.sha256).hexdigest()
 
     def _roll(self) -> None: