lfg2025/botfights
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: tighten auth rate limits to 10/min and add rate limit tests

Browse Source 
Reduce login and nostr/session rate limits from 30 to 10 requests per
minute per IP to prevent brute-force attacks. Add tests verifying 429
response after exceeding the limit.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Dorian
2026-03-13 09:28:38 +00:00
co-authored by Claude Opus 4.6
parent 9de47fd760
commit d4c51f0aac
2 changed files with 64 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/src/routes/auth.ts
+3 -3
View File
@@ -25,8 +25,8 @@ authRouter.get("/check-name/:name", async (c) => {
return c.json({ available: existing.length === 0 })
})
// Login with Nostr pubkey (rate limited: 30 per minute per IP)
authRouter.post('/login', rateLimit(60_000, 30), async (c) => {
// Login with Nostr pubkey (rate limited: 10 per minute per IP)
authRouter.post('/login', rateLimit(60_000, 10), async (c) => {
const parsed = loginSchema.safeParse(await c.req.json().catch(() => ({})))
if (!parsed.success) {
return c.json({ error: 'Invalid pubkey.' }, 400)
@@ -365,7 +365,7 @@ import { verifyNip98Token } from '../middleware/nip98.js'
import { createJwt, extractPubkeyFromAuth } from '../middleware/jwt.js'
// POST /nostr/session — authenticate with NIP-98, receive JWT
authRouter.post('/nostr/session', rateLimit(60_000, 30), async (c) => {
authRouter.post('/nostr/session', rateLimit(60_000, 10), async (c) => {
// Extract NIP-98 token from headers (try multiple header names)
const authHeader = c.req.header('Authorization')
|| c.req.header('nostr-authorization')