Changeset c88783e in Klonkt

Timestamp:

06/11/2026 12:08:23 AM (3 months ago)

Author:

roboburr <roboburr@…>

Branches:

main

Children:

b5bae24

Parents:

353c39c

Message:

fix: rate limiter crash behind Cloudflare/Caddy (req.ip with port)

express-rate-limit v7 validates req.ip and throws ERR_ERL_INVALID_IP_ADDRESS
when the IP contains a port (e.g. "104.23.170.162:11046" via the proxy chain).
Uncaught async -> process crashes -> pm2 restart loop -> EADDRINUSE on :3000.

Fix: custom keyGenerator (clientKey) that strips a trailing IPv4 port + falls
back to the socket, and validate:{ip:false} on both limiters so a non-standard
IP format can never crash the process again.

Co-Authored-By: Claude Opus 4.8 <noreply@…>

File:

• src/middleware/rate-limit.js (modified) (3 diffs)

src/middleware/rate-limit.js

@@ -13 +13 @@
 import rateLimit from 'express-rate-limit';
 import { renderPage } from './render.js';
+
+// Achter Cloudflare/Caddy kan req.ip binnenkomen als "1.2.3.4:11046" (IPv4 met
+// poort). express-rate-limit v7 valideert het IP en gooit anders
+// ERR_ERL_INVALID_IP_ADDRESS — onafgevangen async → het proces crasht (en pm2
+// loopt in een restart-loop). Strip een trailing IPv4-poort, val terug op de
+// socket, en laat IPv6 (meerdere dubbele punten) ongemoeid.
+function clientKey(req) {
+  let ip = req.ip || req.socket?.remoteAddress || '';
+  if (/^\d{1,3}(\.\d{1,3}){3}:\d+$/.test(ip)) ip = ip.split(':')[0];
+  return ip || 'unknown';
+}
 
 function blockedHandler(viewName, bodyClass, friendlyMsg) {
@@ -42 +53 @@
   standardHeaders: true,
   legacyHeaders: false,
+  keyGenerator: clientKey,
+  validate: { ip: false },
   // Only count failed attempts. Successful logins don't burn the budget.
   skipSuccessfulRequests: true,
@@ -52 +65 @@
   standardHeaders: true,
   legacyHeaders: false,
+  keyGenerator: clientKey,
+  validate: { ip: false },
   skipSuccessfulRequests: false,   // any attempt counts (registration spam is the concern)
   handler: blockedHandler('pages/auth-register', 'on-special', 'Too many signup attempts.'),