From 140b5d3cb440ccc7a30a3a1c9aae2f7a9d5efb4a Mon Sep 17 00:00:00 2001
From: Elias Schneider <login@eliasschneider.com>
Date: Wed, 5 Aug 2026 21:48:53 +0200
Subject: [PATCH] fix: don't skip rate limits for loopback addresses

---
 backend/internal/middleware/rate_limit.go | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/backend/internal/middleware/rate_limit.go b/backend/internal/middleware/rate_limit.go
index c6a07f86..06885fdd 100644
--- a/backend/internal/middleware/rate_limit.go
+++ b/backend/internal/middleware/rate_limit.go
@@ -5,7 +5,6 @@ import (
 	"errors"
 	"fmt"
 	"log/slog"
-	"net"
 	"time"
 
 	"github.com/gin-gonic/gin"
@@ -93,9 +92,8 @@ func (m *RateLimitMiddleware) Add(policy string) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		ip := c.ClientIP()
 
-		// Skip rate limiting for localhost and test environment
-		// If the client ip is localhost the request comes from the frontend
-		if common.EnvConfig.AppEnv == common.AppEnvTest || net.ParseIP(ip).IsLoopback() {
+		// Skip rate limiting in test environments
+		if common.EnvConfig.AppEnv == common.AppEnvTest {
 			c.Next()
 			return
 		}