Rate limiting on X-Forwarded-For is spoofable unless you count from the rightmost trusted hop

Any client can send an arbitrary forwarded-for header, and proxies append rather than replace, so the leftmost entry is attacker-controlled text. The correct read walks the list from the right, skipping exactly as many entries as you have trusted proxies, and takes the next value.

Frameworks expose this as a trusted proxy count or CIDR list. Setting Express's trust proxy option to true trusts the entire chain and hands an attacker unlimited quota by rotating a fake header. Behind Cloudflare use the connecting-IP header, behind a cloud load balancer use its documented header, and block the path that lets a client reach the origin directly. Finally, remember that carrier NAT and corporate egress put thousands of users behind one address, so per-IP limits must be generous and paired with per-account limits.