From 26a367a7a10948fe115fd9def3c1bb8ff57d2d77 Mon Sep 17 00:00:00 2001 From: J3vb <192430104+J3vb@users.noreply.github.com> Date: Sun, 19 Jul 2026 08:50:34 +0200 Subject: [PATCH] fix(api): give client-update polling its own rate-limit bucket (W2-1) The empty-prefix middleware shared per-IP buckets with verify-totp, password change, and the sensitive endpoints, so a client's 30/min auto-poll could 429 its own user's 2FA or password change. Dedicated "client_update:" prefix, mirroring "livekit_proxy:". Co-Authored-By: Claude Fable 5 --- Server/api/router.go | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/Server/api/router.go b/Server/api/router.go index 5cbd877c..a40ef231 100644 --- a/Server/api/router.go +++ b/Server/api/router.go @@ -253,8 +253,12 @@ func NewRouter(cfg *config.Config, database *db.DB, ver string, logBuf *admin.Ri // Client auto-update endpoint (unauthenticated). Per-IP rate limited to // bound abuse; the signature fetch is cached inside the updater (DoS fix). + // Dedicated key prefix (mirroring "livekit_proxy:"): the empty-prefix + // middleware would share per-IP buckets with verify-totp, password change, + // and the other sensitive endpoints, so a client's 30/min auto-poll could + // 429 its user's own 2FA or password change. MountClientUpdateRoute( - r.With(RateLimitMiddleware(limiter, clientUpdateRateLimitPerMinute, time.Minute, cfg.Server.TrustedProxies)), + r.With(rateLimitMiddlewareWithPrefix(limiter, "client_update:", clientUpdateRateLimitPerMinute, time.Minute, cfg.Server.TrustedProxies)), u, )