Vulnerability in blocking logic: trusting client-provided data

In a recent security incident, a client's IP-based blocking rule triggered after ten failed login attempts. However, the system began incorrectly banning addresses that had never sent requests, including non-routable ranges. The root cause was the system using data provided by the client in request headers as the source IP. Instead of relying on the actual connection address, the system trusted information that the client could easily spoof. This case highlights the critical importance of validating user-supplied data and using trusted headers (such as correctly configured X-Forwarded-For behind a proxy) to identify request sources. Trusting client-side data without proper verification is a classic design flaw that can lead to denial of service for legitimate users or the bypass of security mechanisms.