From 4960dfc7c67ca161f6dd834752aa1f9244966a3e Mon Sep 17 00:00:00 2001 From: Arnaud Date: Mon, 13 Jul 2026 09:32:37 +0200 Subject: [PATCH] feat: rate limit public routes; backfill v0.9.5 changelog for mobile audit Sign-in/sign-up now throttle at 3 req/10s/IP via better-auth's built-in rate limiter; /r/ and /s/ share links throttle at 60 req/min/IP via proxy.ts using the existing Redis-backed limiter (Next 16's Proxy always runs Node.js, no Edge-runtime blocker after all). Co-Authored-By: Claude Sonnet 5 --- CHANGELOG.md | 11 +++++++++++ apps/web/lib/auth/server.ts | 8 ++++++++ apps/web/lib/changelog.ts | 17 ++++++++++++++++- apps/web/package.json | 2 +- apps/web/proxy.ts | 22 +++++++++++++++++++++- package.json | 2 +- 6 files changed, 58 insertions(+), 4 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index aa22936..e7f518d 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,17 @@ All notable changes to Epicure are documented here. This file is mirrored in-app at `/changelog` (and in the admin dashboard) via `apps/web/lib/changelog.ts` — update both together. +## 0.9.6 — 2026-07-13 09:31 + +### Added +- **Rate limiting on public routes**: sign-in/sign-up now throttle after 3 attempts per 10s per IP; public recipe/shopping-list share links (`/r/`, `/s/`) throttle after 60 requests/min per IP. + +## 0.9.5 — 2026-07-13 09:20 + +### Fixed +- Explore page's "Recipe ideas" input got squeezed to a couple of visible characters on mobile — buttons now stay icon-only below `sm:`. +- The per-recipe chat button could overlap the private-notes save button on short recipe pages. + ## 0.9.4 — 2026-07-13 09:03 ### Fixed diff --git a/apps/web/lib/auth/server.ts b/apps/web/lib/auth/server.ts index deb3fd4..9a8a095 100644 --- a/apps/web/lib/auth/server.ts +++ b/apps/web/lib/auth/server.ts @@ -10,6 +10,14 @@ import { gravatarUrl } from "@/lib/gravatar"; export const auth = betterAuth({ trustedOrigins: [process.env["BETTER_AUTH_URL"] ?? "http://localhost:3000"], + // Explicit rather than relying on the isProduction default so dev/staging + // are protected too. Sign-in/sign-up/change-password/change-email get a + // strict built-in 3-req/10s-per-IP rule (better-auth's default special + // rules) — everything else on /api/auth falls back to 100/10s. + rateLimit: { + enabled: true, + }, + database: drizzleAdapter(db, { provider: "pg", schema: { user: users, session: sessions, account: accounts, verification: verifications }, diff --git a/apps/web/lib/changelog.ts b/apps/web/lib/changelog.ts index e9237f0..1b9503d 100644 --- a/apps/web/lib/changelog.ts +++ b/apps/web/lib/changelog.ts @@ -1,5 +1,5 @@ // Mirrors CHANGELOG.md at the repo root — update both together. -export const APP_VERSION = "0.9.4"; +export const APP_VERSION = "0.9.6"; export type ChangelogEntry = { version: string; @@ -11,6 +11,21 @@ export type ChangelogEntry = { }; export const CHANGELOG: ChangelogEntry[] = [ + { + version: "0.9.6", + date: "2026-07-13 09:31", + added: [ + "**Rate limiting on public routes**: sign-in/sign-up now throttle after 3 attempts per 10s per IP; public recipe/shopping-list share links (`/r/`, `/s/`) throttle after 60 requests/min per IP.", + ], + }, + { + version: "0.9.5", + date: "2026-07-13 09:20", + fixed: [ + "Explore page's \"Recipe ideas\" input got squeezed to a couple of visible characters on mobile — buttons now stay icon-only below `sm:`.", + "The per-recipe chat button could overlap the private-notes save button on short recipe pages.", + ], + }, { version: "0.9.4", date: "2026-07-13 09:03", diff --git a/apps/web/package.json b/apps/web/package.json index ab63b1f..1b2ba03 100644 --- a/apps/web/package.json +++ b/apps/web/package.json @@ -1,6 +1,6 @@ { "name": "@epicure/web", - "version": "0.9.4", + "version": "0.9.6", "private": true, "scripts": { "dev": "next dev", diff --git a/apps/web/proxy.ts b/apps/web/proxy.ts index 1822d13..cb7a784 100644 --- a/apps/web/proxy.ts +++ b/apps/web/proxy.ts @@ -1,9 +1,22 @@ import { NextRequest, NextResponse } from "next/server"; import { getSessionCookie } from "better-auth/cookies"; +import { applyRateLimit } from "@/lib/rate-limit"; const PUBLIC_PATHS = ["/login", "/signup", "/verify-email", "/forgot-password", "/reset-password", "/api/auth", "/r/", "/u/", "/s/", "/docs", "/api/v1/openapi.json", "/api/webhooks", "/api/v1/invites/", "/api/internal/"]; const ADMIN_PATHS = ["/admin"]; +// Unauthenticated, publicly-linked pages (shared recipes/shopping lists) — +// no per-user identity to key on, so rate-limit by IP to deter scraping. +const IP_RATE_LIMITED_PATHS = ["/r/", "/s/"]; +const IP_RATE_LIMIT = 60; +const IP_RATE_LIMIT_WINDOW_SECONDS = 60; + +function getClientIp(request: NextRequest): string { + const forwardedFor = request.headers.get("x-forwarded-for"); + if (forwardedFor) return forwardedFor.split(",")[0]!.trim(); + return request.headers.get("x-real-ip") ?? "unknown"; +} + export async function proxy(request: NextRequest) { const { pathname } = request.nextUrl; @@ -11,7 +24,14 @@ export async function proxy(request: NextRequest) { const isAdmin = ADMIN_PATHS.some((p) => pathname.startsWith(p)); const isApi = pathname.startsWith("/api/v1"); - if (isPublic) return NextResponse.next(); + if (isPublic) { + if (IP_RATE_LIMITED_PATHS.some((p) => pathname.startsWith(p))) { + const ip = getClientIp(request); + const limited = await applyRateLimit(`rl:public:${ip}`, IP_RATE_LIMIT, IP_RATE_LIMIT_WINDOW_SECONDS); + if (limited) return limited; + } + return NextResponse.next(); + } // API-key clients authenticate via `Authorization: Bearer ek_...`, not a // session cookie — they'd otherwise be rejected here before ever reaching diff --git a/package.json b/package.json index 22b22fb..4276f66 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "epicure", - "version": "0.9.4", + "version": "0.9.6", "private": true, "scripts": { "dev": "pnpm --filter web dev",