External/SnapOtter
1
0
Fork 0
mirror of https://github.com/snapotter-hq/SnapOtter.git synced 2026-08-03 07:46:42 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): correct Docker rate limit defaults

Browse Source 
- LOGIN_ATTEMPT_LIMIT: 500 -> 30 in Dockerfile (matching code default)
- RATE_LIMIT_PER_MIN=0 now means no global limit (50K ceiling) instead
  of 1 req/min, preserving backward compatibility with existing deploys
  while keeping per-route limits (login brute-force) active
This commit is contained in:
SnapOtter
2026-05-14 23:02:25 +08:00
parent ca2ef5b3f4
commit b449bd1a56
2 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/api/src/index.ts
+2 -2
View File
@@ -156,9 +156,9 @@ app.addHook("onSend", async (_request, reply) => {
});
// Always register rate-limit plugin so per-route limits (login brute-force protection) work.
// RATE_LIMIT_PER_MIN defaults to 300 via env schema; floor at 1 as a safety net.
// RATE_LIMIT_PER_MIN=0 means no global limit (per-route limits still apply).
await app.register(rateLimit, {
max: Math.max(env.RATE_LIMIT_PER_MIN, 1),
max: env.RATE_LIMIT_PER_MIN > 0 ? env.RATE_LIMIT_PER_MIN : 50_000,
timeWindow: "1 minute",
allowList: (request) => !request.url.startsWith("/api/"),
});