anas/divan
1
0
Fork 0
Code Issues 12 Pull Requests Actions Packages Projects Releases Wiki Activity

Security: a made-up x-client-ip can no longer get round the sign-in and sign-up limits #76

Merged
anas merged 1 commits from fix/trusted-client-ip into main 2026-10-09 15:58:42 +00:00
Conversation 0 Commits 1 Files Changed 4 +32 -3

1 Commits

Author SHA1 Message Date
Anas Rashid
ad7f3cb666 Rate limits can't be dodged with a made-up x-client-ip: the API believes it only from the site (DIVAN_SITE_KEY in x-site-key, timing-safe; this machine only when no key is set) 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-09 17:38:55 +02:00