express-rate-limit throws ValidationError about X-Forwarded-For on Replit

What happens: your app runs behind Replit's proxy, so every request's direct IP is the proxy's IP. All users look like one user → one shared limit → 429 for everyone.

trust proxy tells Express to read the real client IP from X-Forwarded-For. But true means 'trust the whole header', and a client can put anything in it, so an attacker rotates fake IPs and bypasses your limit.

Use a number instead, the count of proxies in front of you:

app.set('trust proxy', 1)

Then verify: add a temporary /ip route that returns req.ip, open it from your phone and laptop, you should see two different real IPs.

Also: if your users are logged in, key the limiter on user id (keyGenerator: (req) => req.user.id). IP limits hit people on shared networks, like a whole school or office behind one IP.

Before settling on 1, log req.headers['x-forwarded-for'] once in production. If you see two IPs added by the platform (client, proxy), you need 2. The right number depends on how many hops the host puts in front of you.