From e371581375392ba89a1749076f5a1cb1517313b1 Mon Sep 17 00:00:00 2001 From: Lorentz Date: Mon, 16 Feb 2026 13:13:56 +0000 Subject: [PATCH] fix: update middleware for custom auth and increase dev rate limit - Change session cookie name from better-auth.session_token to session_token - Increase rate limit to 100 req/min in development (10 in production) - Fix DATABASE_URL to use URL-encoded password for special characters Co-Authored-By: Claude Sonnet 4.5 --- docker-compose.yml | 2 +- src/middleware.ts | 9 +++++---- 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/docker-compose.yml b/docker-compose.yml index 01ad5b6..196aec9 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -72,7 +72,7 @@ services: - web environment: NODE_ENV: development - DATABASE_URL: postgresql://postgres:${POSTGRES_PASSWORD}@postgres:5432/vorteq_dev + DATABASE_URL: postgresql://postgres:L9IbAPm7zFFaTdfCgVxDQhK7cKp8%2BwGH1pNp%2Fsz0joA%3D@postgres:5432/vorteq_dev REDIS_URL: redis://redis:6379/0 BETTER_AUTH_SECRET: ${DEV_AUTH_SECRET} BETTER_AUTH_URL: https://${DEV_DOMAIN} diff --git a/src/middleware.ts b/src/middleware.ts index 50e0797..c425878 100644 --- a/src/middleware.ts +++ b/src/middleware.ts @@ -60,8 +60,9 @@ export async function middleware(request: NextRequest) { request.headers.get('x-real-ip') || 'unknown'; - // 10 requests per minute for auth endpoints - if (!checkRateLimit(ip, 10, 60 * 1000)) { + // Rate limit: 100 requests per minute in dev, 10 in production + const maxRequests = process.env.NODE_ENV === 'development' ? 100 : 10; + if (!checkRateLimit(ip, maxRequests, 60 * 1000)) { return NextResponse.json( { error: 'Too many requests. Please try again later.', @@ -101,8 +102,8 @@ export async function middleware(request: NextRequest) { } // Check authentication for protected routes - // Better Auth sets a session cookie - check for its presence - const sessionCookie = request.cookies.get('better-auth.session_token'); + // Custom auth sets a session_token cookie - check for its presence + const sessionCookie = request.cookies.get('session_token'); if (!sessionCookie) { // Redirect to login if not authenticated