openvibers/openvibe.trade Commits

/auth/me is not counted by the sign-in limiter: 60 page views in 15 minutes made a signed-in visitor look signed out (#103)

OP OpenVibers committed 17 days ago · 16154b7c73 · 1 file, +2 −1

Changes

ddiff --git a/server/app.js b/server/app.js
iindex 00f7ae2..53661cf 100644
---- a/server/app.js
++++ b/server/app.js
@@@ -187,7 +187,8 @@ async function createApp(opts = {}) {
app.use(createWebhook({ store, config, ingest: ctx.sync, log, accountData: ctx.accountData, accountSend: ctx.accountSend }).router);
// ── Sign-in (OAuth2 client of OpenVibe.Network) ─────────
-- app.use('/auth/', rateLimit({ windowMs: 15 * 60_000, max: 60, standardHeaders: true, legacyHeaders: false }));
++ // /auth/me is the navbar's who-is-signed-in read on every page, so it is not counted with sign-ins: 60 page views in 15 minutes made a signed-in visitor look signed out.
++ app.use('/auth/', rateLimit({ windowMs: 15 * 60_000, max: 60, skip: (req) => req.path === '/me', standardHeaders: true, legacyHeaders: false }));
app.use('/auth', ctx.auth.router(express));
{
const legal = require('openvibe-shared/legal');