Added back Remote Cursors

server/middleware.ts

@@ -19,7 +19,7 @@ export const securityHeaders = helmet({
       frameSrc: ["'none'"],
     },
   },
-  crossOriginEmbedderPolicy: false, // Req. for Socket.io
+  crossOriginEmbedderPolicy: false,
   hsts: {
     maxAge: 31536000,
     includeSubDomains: true,
@@ -37,6 +37,18 @@ export const createRateLimit = rateLimit({
   },
   standardHeaders: true,
   legacyHeaders: false,
+  keyGenerator: (req: Request) => {
+    const forwarded = req.headers['x-forwarded-for'];
+    if (forwarded) {
+      return typeof forwarded === 'string' 
+        ? forwarded.split(',')[0].trim() 
+        : forwarded[0];
+    }
+    return req.ip || 
+           req.headers['x-real-ip'] as string || 
+           req.connection.remoteAddress || 
+           'unknown';
+  },
   handler: (req: Request, res: Response) => {
     securityLogger.rateLimitExceeded(
       req.ip || req.connection.remoteAddress || 'unknown',