From 170a6254385f18b6b9ee3ec9c32176b210eca5ef Mon Sep 17 00:00:00 2001 From: Sparsh Date: Tue, 19 May 2026 00:56:42 +0530 Subject: [PATCH] fix(server): restore IPv6 /56 comment and fix rate-limit fallback bucket ipKeyGenerator('') returned '' as the rate-limit key when both req.ip and req.socket?.remoteAddress were undefined, silently merging all anonymous requests into an empty-string bucket instead of the intended 'unknown' sentinel. Switch to a conditional: only call ipKeyGenerator when an IP is present, otherwise fall back to 'unknown'. Restores the IPv6 /56 normalisation comment dropped in aa36869 (see issue #1360). --- gitnexus/src/server/validation.ts | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/gitnexus/src/server/validation.ts b/gitnexus/src/server/validation.ts index 83fa6922a..04be58d30 100644 --- a/gitnexus/src/server/validation.ts +++ b/gitnexus/src/server/validation.ts @@ -151,7 +151,13 @@ export function createRouteLimiter(opts?: RouteLimiterOverrides): RateLimitReque standardHeaders: 'draft-7', legacyHeaders: false, passOnStoreError: true, - keyGenerator: (req: Request) => ipKeyGenerator(req.ip ?? req.socket?.remoteAddress ?? ''), + keyGenerator: (req: Request) => { + // Pass through ipKeyGenerator so IPv6 addresses are normalised to their /56 + // subnet — without this, each IPv6 address gets its own counter and the limit + // is trivially bypassed (#1360). + const ip = req.ip ?? req.socket?.remoteAddress; + return ip ? ipKeyGenerator(ip) : 'unknown'; + }, message: { error: 'Too many requests, please try again later.' }, ...opts, });