68cb20edba
POST /api/guest-orders is fully public (permitAll) with no captcha,
throttling, or IP-based limiting. An attacker can flood the orders table
(DB bloat / DoS) and mass-generate self-confirmed paid orders.
Changes:
- GuestOrderRateLimitFilter: in-memory sliding-window rate limiter
(OncePerRequestFilter + @Component). Per-IP limits:
POST /api/guest-orders: 5 req/min (configurable)
Other /api/guest-orders/**: 20 req/min (configurable)
Returns 429 with Swedish JSON error when exceeded.
Respects X-Forwarded-For and X-Real-IP headers.
- SecurityConfig: register the filter before JWT filter
- GuestOrderControllerTest: set high limits (1000) and reset filter
state in @BeforeEach to avoid cross-test interference
Config via application properties:
app.rate-limit.guest-create (default 5)
app.rate-limit.guest-default (default 20)
Phase 0 interim: in-memory, per-JVM, resets on restart. For production,
use Bucket4j + Redis or nginx limit_req.
Closes #19
|
||
|---|---|---|
| .. | ||
| src | ||
| .gitattributes | ||
| .gitignore | ||
| build.gradle | ||
| gradlew.bat | ||