Bypass Rate Limits on app.snapchat.com API Endpoint via X-Forwarded-For Header

Summary

An attacker can bypass the rate limiting in place at app.snapchat.com by setting the X-Forwarded-For header to 127.0.0.1 in POST requests to app.snapchat.com/stories_everywhere/download_sms and several other endpoints. This bypasses the controls in place for this endpoint, which appears to have strict rate limits.