diff options
Diffstat (limited to 'packages/meshbay-hub/src/meshbay_hub/api')
| -rw-r--r-- | packages/meshbay-hub/src/meshbay_hub/api/middleware.py | 10 |
1 files changed, 7 insertions, 3 deletions
diff --git a/packages/meshbay-hub/src/meshbay_hub/api/middleware.py b/packages/meshbay-hub/src/meshbay_hub/api/middleware.py index bed7b54..3a2a5c3 100644 --- a/packages/meshbay-hub/src/meshbay_hub/api/middleware.py +++ b/packages/meshbay-hub/src/meshbay_hub/api/middleware.py @@ -7,7 +7,11 @@ to mitigate credential stuffing and registration floods. """ from slowapi import Limiter -from slowapi.util import get_remote_address -# Rate limiter instance — mounted on the FastAPI app in app.py -limiter = Limiter(key_func=get_remote_address) +from meshbay_hub.api.netutil import client_ip + +# Rate limiter instance — mounted on the FastAPI app in app.py. +# Keyed on client_ip, not slowapi's get_remote_address: behind Caddy every +# request's peer is loopback, so the peer address put the whole internet in one +# bucket — ten node sign-ins a minute, shared by every node there is. +limiter = Limiter(key_func=client_ip) |