blitzwing/cobalt-7
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

api/core: generate JWT rate limiting key in auth handler

Browse source
This commit is contained in:
dumbmoron 2024-10-04 17:03:57 +00:00
parent 418602ca87
commit dcd33803c1
No known key found for this signature in database
1 changed files with 2 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
api/src/core/api.js
View file

@ -81,12 +81,7 @@ export const runAPI = (express, app, __dirname) => {
max: env.rateLimitMax,
standardHeaders: true,
legacyHeaders: false,
keyGenerator: req => {
if (req.authorized) {
return generateHmac(req.header("Authorization"), ipSalt);
}
return generateHmac(getIP(req), ipSalt);
},
keyGenerator: req => req.rateLimitKey || generateHmac(getIP(req), ipSalt),
handler: handleRateExceeded
})
@ -147,7 +142,7 @@ export const runAPI = (express, app, __dirname) => {
return fail(res, "error.api.auth.jwt.invalid");
}
req.authorized = true;
req.rateLimitKey = generateHmac(req.header("Authorization"), ipSalt);
} catch {
return fail(res, "error.api.generic");
}