diff options
| author | Christophe Besson <cbesson@gmail.com> | 2026-09-27 22:20:14 +0200 |
|---|---|---|
| committer | Christophe Besson <cbesson@gmail.com> | 2026-09-27 22:20:14 +0200 |
| commit | 4fbd2e5c5e21ab0d26bb16245dd656557f87765b (patch) | |
| tree | 5465fea1b58c17ca0e47dd719c464b733e4d3276 /packages/meshbay-hub/tests/test_spa_ordering.py | |
| parent | d8357d864e323c2f7febce3b625478e0de21327b (diff) | |
| download | meshbay-4fbd2e5c5e21ab0d26bb16245dd656557f87765b.tar.gz | |
fix(hub): rate-limit per client, not per proxy
Behind Caddy every request's TCP peer is loopback, and the limiter was keyed
on that peer (slowapi's get_remote_address), so each limit was one bucket for
the whole internet: ten node sign-ins a minute shared by every node. A node
starting while others signed in got 429 and sat in waiting_for_hub, which the
desktop app took for no node at all. Key it on client_ip, which already
resolves X-Forwarded-For from a trusted proxy and was written for this.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Diffstat (limited to 'packages/meshbay-hub/tests/test_spa_ordering.py')
0 files changed, 0 insertions, 0 deletions