External/SnapOtter
1
0
Fork 0
mirror of https://github.com/snapotter-hq/SnapOtter.git synced 2026-08-03 07:46:42 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): correct Docker rate limit defaults

Browse Source 
- LOGIN_ATTEMPT_LIMIT: 500 -> 30 in Dockerfile (matching code default)
- RATE_LIMIT_PER_MIN=0 now means no global limit (50K ceiling) instead
  of 1 req/min, preserving backward compatibility with existing deploys
  while keeping per-route limits (login brute-force) active
This commit is contained in:
SnapOtter
2026-05-14 23:02:25 +08:00
parent ca2ef5b3f4
commit b449bd1a56
2 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/api/src/index.ts
+2 -2
View File
@@ -156,9 +156,9 @@ app.addHook("onSend", async (_request, reply) => {
}); });
// Always register rate-limit plugin so per-route limits (login brute-force protection) work. // Always register rate-limit plugin so per-route limits (login brute-force protection) work.
// RATE_LIMIT_PER_MIN defaults to 300 via env schema; floor at 1 as a safety net. // RATE_LIMIT_PER_MIN=0 means no global limit (per-route limits still apply).
await app.register(rateLimit, { await app.register(rateLimit, {
max: Math.max(env.RATE_LIMIT_PER_MIN, 1), max: env.RATE_LIMIT_PER_MIN > 0 ? env.RATE_LIMIT_PER_MIN : 50_000,
timeWindow: "1 minute", timeWindow: "1 minute",
allowList: (request) => !request.url.startsWith("/api/"), allowList: (request) => !request.url.startsWith("/api/"),
}); });
docker/Dockerfile
+1 -1
View File
@@ -271,7 +271,7 @@ ENV PORT=1349 \
MAX_SPLIT_GRID=100 \ MAX_SPLIT_GRID=100 \
MAX_PDF_PAGES=0 \ MAX_PDF_PAGES=0 \
SESSION_DURATION_HOURS=168 \ SESSION_DURATION_HOURS=168 \
LOGIN_ATTEMPT_LIMIT=500 \ LOGIN_ATTEMPT_LIMIT=30 \
LOG_LEVEL=info \ LOG_LEVEL=info \
TRUST_PROXY=true \ TRUST_PROXY=true \
OIDC_ENABLED=false \ OIDC_ENABLED=false \