fix: per-IP auth rate limiting instead of one global bucket · f879ce1866 - Mangalord

fix: per-IP auth rate limiting instead of one global bucket

All checks were successful

deploy / test-frontend (push) Successful in 10m44s

Details

deploy / build-and-push (push) Successful in 11m35s

Details

deploy / deploy (push) Successful in 12s

Details

deploy / test-backend (push) Successful in 31m21s

Details

A single global token bucket let one attacker at the sustained rate 429
every user's login/register/change-password. Key buckets by client IP: the
SvelteKit proxy now stamps the real peer address onto X-Forwarded-For
(overriding any client-supplied value, anti-spoof), and axum reads it via a
ClientIp extractor — but only when AUTH_TRUSTED_PROXY is set, else it falls
back to the shared bucket (today's behavior). The per-IP map is bounded
(10k IPs, idle buckets pruned) so a spoofed-IP spray can't grow it.

AUTH_TRUSTED_PROXY defaults false (safe for a directly-exposed backend);
compose sets it true since the proxy is the single trusted hop.

Bump to 0.124.12.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

This commit is contained in:

MechaCat02

2026-07-08 07:07:06 +02:00

parent bf425cf8e6

commit f879ce1866

11 changed files with 314 additions and 47 deletions

									
										2

backend/Cargo.toml
									
												View File
												
				@@ -1,6 +1,6 @@

				[package]

				name = "mangalord"

				version = "0.124.11"

				version = "0.124.12"

				edition = "2021"

				default-run = "mangalord"

2 backend/Cargo.toml Unescape Escape View File

2

backend/Cargo.toml

View File