2 Bypass of #1067533 rate limit via X-Forwarded-For<space>: Source IP on ( www.trycourier.app )

Summary

A vulnerability with AWS API Gateway was uncovered that allowed rate limiting to be bypassed when the X-Forwarded-For headed was manipulated (a string added to the header key)

I was able to bypass the rate limit by adding extra space before the colon X-Forwarded-For<space>: 127.0.0.1. The actual bug was in AWS API Gateway that allowed rate limiting to be bypassed. Now Both of the company fixed the issue after reporting them.