Koko210/immich-folio
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(security): resolve rate-limiting IP spoofing and eviction bypass

Browse Source
This commit is contained in:
ralksta
2026-03-15 07:41:49 +01:00
parent 922302ce5c
commit e9154cedb8
4 changed files with 20 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
app/api/auth/route.ts
View File

@@ -5,20 +5,14 @@
import { NextRequest, NextResponse } from 'next/server';
import { authenticate, isProtected } from '@/lib/auth';
import { checkRateLimit } from '@/lib/rate-limit';
import { checkRateLimit, getClientIp } from '@/lib/rate-limit';
/** Tight limit for auth attempts — 10 per minute per IP. */
const AUTH_RPM = 10;
export async function POST(request: NextRequest) {
// ── Rate limiting (brute-force protection) ──────────
// Security: Prioritize x-real-ip (set by trusted reverse proxies like nginx/Traefik)
// over x-forwarded-for which can be spoofed by clients.
// Note: request.ip was removed in Next.js 15+.
const ip =
request.headers.get('x-real-ip') ??
request.headers.get('x-forwarded-for')?.split(',')[0].trim() ??
'unknown';
const ip = getClientIp(request);
const { success } = checkRateLimit(`auth:${ip}`, AUTH_RPM);
if (!success) {

9
app/api/exif/[id]/route.ts
View File

@@ -9,7 +9,7 @@ import { NextRequest, NextResponse } from 'next/server';
import { immich } from '@/lib/immich';
import { decodeAssetId } from '@/lib/tokens';
import { getConfig } from '@/lib/config';
import { checkRateLimit } from '@/lib/rate-limit';
import { checkRateLimit, getClientIp } from '@/lib/rate-limit';
export async function GET(request: NextRequest, { params }: { params: Promise<{ id: string }> }) {
const config = getConfig();
@@ -20,12 +20,7 @@ export async function GET(request: NextRequest, { params }: { params: Promise<{
}
// ── Rate limiting ──────────────────────────────────
// Security: Prioritize x-real-ip (set by trusted reverse proxies like nginx/Traefik)
// over x-forwarded-for which can be spoofed by clients.
const ip =
request.headers.get('x-real-ip') ??
request.headers.get('x-forwarded-for')?.split(',')[0].trim() ??
'unknown';
const ip = getClientIp(request);
const { success, resetAt } = checkRateLimit(`exif:${ip}`, config.rateLimitRpm);
if (!success) {

10
app/api/image/[id]/route.ts
View File

@@ -11,7 +11,7 @@ import { NextRequest, NextResponse } from 'next/server';
import { immich, ImageSize } from '@/lib/immich';
import { decodeAssetId } from '@/lib/tokens';
import { getConfig } from '@/lib/config';
import { checkRateLimit } from '@/lib/rate-limit';
import { checkRateLimit, getClientIp } from '@/lib/rate-limit';
const VALID_SIZES: ImageSize[] = ['thumbnail', 'preview', 'original'];
@@ -26,13 +26,7 @@ function widthToSize(w: number): ImageSize {
export async function GET(request: NextRequest, { params }: { params: Promise<{ id: string }> }) {
// ── Rate limiting ──────────────────────────────────
// Security: Prioritize x-real-ip (set by trusted reverse proxies like nginx/Traefik)
// over x-forwarded-for which can be spoofed by clients.
// Note: request.ip was removed in Next.js 15+.
const ip =
request.headers.get('x-real-ip') ??
request.headers.get('x-forwarded-for')?.split(',')[0].trim() ??
'unknown';
const ip = getClientIp(request);
const { success, remaining, resetAt } = checkRateLimit(ip, getConfig().rateLimitRpm);
if (!success) {