Echo has Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration

Summary When echo.New is used without explicitly setting EchoIPExtractor, the RealIP method falls back to reading the client-supplied X-Forwarded-For or X-Real-IP header without any proxy-origin validation. The default RateLimiter middleware derives its per-client identifier from ctx.RealIP, so a...