Feature: Implement Sign-Up Rate Limiting #134
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Did you test it on staging? |
- Introduced `@upstash/ratelimit` dependency for improved rate limiting functionality. - Replaced manual increment logic with Upstash's rate limiting utility in the sign-up process. - Updated sign-up rate limiting checks to enhance logging and error handling. - Refactored related functions to streamline the rate limiting implementation.
…up process - Renamed `TruethyOrFalsy` to `NumericBoolean` for clarity in environment schema. - Added new fields for sign-up attempts limit and window in the environment schema. - Updated rate limiting functions to improve clarity and logging for sign-up attempts. - Refactored related code to enhance consistency in rate limiting checks.
…n for sign-up process - Renamed `SIGN_UP_ATTEMPTS_LIMIT` to `SIGN_UP_ATTEMPTS_LIMIT_PER_WINDOW` for clarity. - Added new environment variables for sign-up rate limiting configuration. - Updated documentation and related code to reflect the changes in rate limiting logic.
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
- Added checks to ensure a valid IP address is retrieved in both the auth confirmation route and sign-up action. - Returns an error response if the IP address is invalid, improving error handling and user feedback.
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
…lidation - Introduced a custom string type for validating positive numbers in the environment schema. - Updated rate limiting configuration to ensure that limits and windows are positive numbers. - Improved documentation to reflect the new validation requirements for rate limiting parameters.
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
- Refactored IP address extraction in the auth confirmation route and sign-up action to use a dedicated utility function. - Enhanced logging to capture errors when IP headers are missing in production environments. - Updated documentation to clarify the handling of IP addresses in the rate limiting system, including support for development environments.
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
…d simplifying logic
|
bugbot run |
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
| export const ENABLE_SIGN_UP_RATE_LIMITING = | ||
| process.env.ENABLE_SIGN_UP_RATE_LIMITING === '1' && | ||
| process.env.KV_REST_API_URL && | ||
| process.env.KV_REST_API_TOKEN |
There was a problem hiding this comment.
Bug: Rate Limiting Flag Evaluates Incorrectly
The ENABLE_SIGN_UP_RATE_LIMITING flag's logic is flawed. It evaluates to a non-boolean string (e.g., KV_REST_API_TOKEN's value or an empty string) when enabled, which may cause unexpected conditional behavior. It also treats empty strings for KV_REST_API_URL and KV_REST_API_TOKEN as valid, potentially leading to silent rate limiting failures.
3 participants
This pr adds an ip based sign-up counter using Redis. all crucial values are configurable via environment variables.
The configuration for production is currently set to:
If the user has too many sign-up's, he might see rate limit alert like this:
Note
Introduces IP-based sign-up rate limiting using Vercel KV with configurable env vars and integrates checks into
signUpAction.src/server/auth/auth-actions.tsusingipAddressand new helpersincrementAndCheckSignUpRateLimit/decrementSignUpRateLimit.src/server/auth/ratelimit.tsimplements atomic Redis Lua scripts for increment/decrement and TTL handling.email_address_invalid) and warn when no IP in production.ENABLE_SIGN_UP_RATE_LIMITINGinsrc/configs/flags.ts; add KV-backedKV_KEYS.RATE_LIMIT_SIGN_UPand defaults insrc/configs/limits.ts.src/lib/env.tsschemas: add numeric-boolean support and new server varsENABLE_SIGN_UP_RATE_LIMITING,SIGN_UP_LIMIT_PER_WINDOW,SIGN_UP_WINDOW_HOURS; tighten clientNEXT_PUBLIC_*booleans..env.example: document optional Auth rate limiting envs.@vercel/functionsdependency.tsconfig.json: setjsxtopreserve.Written by Cursor Bugbot for commit 0f99957. This will update automatically on new commits. Configure here.