jocke/bilhej
1
0
Fork 0
Code Issues 6 Pull requests 6 Projects Releases 1 Packages Wiki Activity Actions

feat(security): add per-IP rate limiting on guest-order endpoints (#19) #29

Open
hermes wants to merge 1 commit from fix/guest-order-rate-limiting into master
pull from: fix/guest-order-rate-limiting
merge into: jocke:master
Conversation 0 Commits 1 Files changed 3 +140 -2

1 commit

Author SHA1 Message Date
Hermes Agent
68cb20edba feat(security): add per-IP rate limiting on guest-order endpoints
Some checks failed
CI / Lint, type check, unit tests, coverage (pull_request) Successful in 2m49s
Details
CI / E2E browser tests (pull_request) Failing after 1m45s
Details 
POST /api/guest-orders is fully public (permitAll) with no captcha,
throttling, or IP-based limiting. An attacker can flood the orders table
(DB bloat / DoS) and mass-generate self-confirmed paid orders.

Changes:
  - GuestOrderRateLimitFilter: in-memory sliding-window rate limiter
    (OncePerRequestFilter + @Component). Per-IP limits:
      POST /api/guest-orders: 5 req/min (configurable)
      Other /api/guest-orders/**: 20 req/min (configurable)
    Returns 429 with Swedish JSON error when exceeded.
    Respects X-Forwarded-For and X-Real-IP headers.
  - SecurityConfig: register the filter before JWT filter
  - GuestOrderControllerTest: set high limits (1000) and reset filter
    state in @BeforeEach to avoid cross-test interference

Config via application properties:
  app.rate-limit.guest-create (default 5)
  app.rate-limit.guest-default (default 20)

Phase 0 interim: in-memory, per-JVM, resets on restart. For production,
use Bucket4j + Redis or nginx limit_req.

Closes #19
 2026-07-18 11:45:13 +00:00