rbrooks/WeatherBot

Watch

Fork 0

App-native rate limiting for /p/* public routes #10

New issue

Closed

opened 2026-06-23 23:15:03 +00:00 by rbrooks · 1 comment

rbrooks commented

2026-06-23 23:15:03 +00:00

Owner

Target release: v1.1.0

Add app-native rate limiting / abuse mitigation for public token lookups (/p/{token}) for deployments where the reverse proxy can't enforce it cleanly. The MVP documented this as a proxy responsibility; this issue tracks the in-app fallback.

Source: docs/ROADMAP.md → Public Alert Detail Pages Phase 6; docs/HANDOFF.md → Remaining item #5.

**Target release:** v1.1.0 Add app-native rate limiting / abuse mitigation for public token lookups (`/p/{token}`) for deployments where the reverse proxy can't enforce it cleanly. The MVP documented this as a proxy responsibility; this issue tracks the in-app fallback. Source: `docs/ROADMAP.md` → Public Alert Detail Pages Phase 6; `docs/HANDOFF.md` → Remaining item #5.

rbrooks added the

area:public-pages

type:security

v1.1.0

labels

2026-06-23 23:16:40 +00:00

rbrooks added this to the v1.1.0 - Operations, observability & CD milestone

2026-06-23 23:23:14 +00:00

claude-bot referenced this issue

2026-07-17 23:51:25 +00:00

Retire drift-prone roadmap/plan docs (work now lives in Issues + Milestones) #38

claude-bot referenced this issue

2026-07-18 00:03:02 +00:00

Retire drift-prone roadmap/plan docs #39

rbrooks referenced this issue from a commit

2026-07-18 18:07:23 +00:00

Add public-link console, /p/* rate limiting, SMS links, retention, config I/O

claude-bot referenced this issue

2026-07-18 18:07:41 +00:00

v1.1.0 Phase 4: public-link console, rate limiting, retention, config I/O #97

claude-bot commented

2026-07-18 18:17:46 +00:00

Contributor

Done in #97 (merged). Added an in-process sliding-window rate limiter on the public /p/{token} routes, keyed by client IP (honors left-most X-Forwarded-For behind the reverse proxy), returning 429 + Retry-After when exceeded. Configurable via PUBLIC_RATE_LIMIT_ENABLED/REQUESTS/WINDOW_SECONDS. It's per-process (documented — a proxy/Redis limiter would be needed for multi-instance). Authenticated app routes are not limited.

Done in #97 (merged). Added an in-process sliding-window rate limiter on the public `/p/{token}` routes, keyed by client IP (honors left-most `X-Forwarded-For` behind the reverse proxy), returning 429 + `Retry-After` when exceeded. Configurable via `PUBLIC_RATE_LIMIT_ENABLED/REQUESTS/WINDOW_SECONDS`. It's per-process (documented — a proxy/Redis limiter would be needed for multi-instance). Authenticated app routes are not limited.

claude-bot closed this issue

2026-07-18 18:17:58 +00:00

No milestone

No project

No assignees

2 participants

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

rbrooks/WeatherBot#10

No description provided.

Rows
Columns