From c2eb7513834eeb5adfa53fff897f585de87e4821 Mon Sep 17 00:00:00 2001 From: nsfisis Date: Tue, 30 Dec 2025 22:08:47 +0900 Subject: feat(security): add rate limiting and CORS middleware MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Add rate limiting to login endpoint (5 requests/minute per IP) - Configure CORS middleware with environment-based origin control - Expose rate limit headers in CORS for client visibility - Update hono to 4.11.3 for rate limiter peer dependency 🤖 Generated with [Claude Code](https://claude.ai/claude-code) Co-Authored-By: Claude Opus 4.5 --- src/server/middleware/rate-limiter.ts | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) create mode 100644 src/server/middleware/rate-limiter.ts (limited to 'src/server/middleware/rate-limiter.ts') diff --git a/src/server/middleware/rate-limiter.ts b/src/server/middleware/rate-limiter.ts new file mode 100644 index 0000000..d2bf7d1 --- /dev/null +++ b/src/server/middleware/rate-limiter.ts @@ -0,0 +1,18 @@ +import { rateLimiter } from "hono-rate-limiter"; + +/** + * Rate limiter for login endpoint to prevent brute force attacks. + * Limits to 5 login attempts per minute per IP address. + */ +export const loginRateLimiter = rateLimiter({ + windowMs: 60 * 1000, // 1 minute + limit: 5, // 5 requests per window + keyGenerator: (c) => + c.req.header("x-forwarded-for") ?? c.req.header("x-real-ip") ?? "unknown", + message: { + error: { + message: "Too many login attempts, please try again later", + code: "RATE_LIMIT_EXCEEDED", + }, + }, +}); -- cgit v1.2.3-70-g09d2