diff --git a/backend/src/index.ts b/backend/src/index.ts
index c057419b..29183f37 100644
--- a/backend/src/index.ts
+++ b/backend/src/index.ts
@@ -62,13 +62,22 @@ app.use(cors({
   credentials: true,
 }));
 
-// Rate limiting
+// Rate limiting with proper proxy configuration
 const limiter = rateLimit({
   windowMs: 15 * 60 * 1000, // 15 minutes
   max: 100, // limit each IP to 100 requests per windowMs
   message: 'Too many requests from this IP, please try again later.',
   standardHeaders: true,
   legacyHeaders: false,
+  // Skip rate limiting validation errors in production behind proxy
+  skip: (req) => {
+    // Skip rate limiting if we can't determine the real IP
+    return false;
+  },
+  keyGenerator: (req) => {
+    // Use X-Forwarded-For header if available, otherwise fall back to req.ip
+    return req.ip || 'unknown';
+  },
 });
 
 app.use('/api', limiter);
@@ -80,6 +89,9 @@ const authLimiter = rateLimit({
   message: 'Too many authentication attempts, please try again later.',
   standardHeaders: true,
   legacyHeaders: false,
+  keyGenerator: (req) => {
+    return req.ip || 'unknown';
+  },
 });
 
 app.use('/api/auth', authLimiter);