Every user appears to come from one address

• A

  Read the forwarded-for header, and only trust it from the proxy

• B

  Read the forwarded-for header, which the proxy always sets correctly

• C

  Configure the proxy to preserve the original source address

• D

  Rate limit at the proxy instead of the application