lorentz/quest-vorteq
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: update middleware for custom auth and increase dev rate limit
Some checks failed
Build and Deploy / build (push) Successful in 3m53s
Details
Build and Deploy / deploy (push) Failing after 4s
Details

Browse source 
- Change session cookie name from better-auth.session_token to session_token
- Increase rate limit to 100 req/min in development (10 in production)
- Fix DATABASE_URL to use URL-encoded password for special characters

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
This commit is contained in:
Lorentz 2026-02-16 13:13:56 +00:00
parent a123d5e394
commit e371581375
2 changed files with 6 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

2
docker-compose.yml
View file

@ -72,7 +72,7 @@ services:
- web - web
environment: environment:
NODE_ENV: development NODE_ENV: development
DATABASE_URL: postgresql://postgres:${POSTGRES_PASSWORD}@postgres:5432/vorteq_dev DATABASE_URL: postgresql://postgres:L9IbAPm7zFFaTdfCgVxDQhK7cKp8%2BwGH1pNp%2Fsz0joA%3D@postgres:5432/vorteq_dev
REDIS_URL: redis://redis:6379/0 REDIS_URL: redis://redis:6379/0
BETTER_AUTH_SECRET: ${DEV_AUTH_SECRET} BETTER_AUTH_SECRET: ${DEV_AUTH_SECRET}
BETTER_AUTH_URL: https://${DEV_DOMAIN} BETTER_AUTH_URL: https://${DEV_DOMAIN}

9
src/middleware.ts
View file

@ -60,8 +60,9 @@ export async function middleware(request: NextRequest) {
request.headers.get('x-real-ip') || request.headers.get('x-real-ip') ||
'unknown'; 'unknown';
// 10 requests per minute for auth endpoints // Rate limit: 100 requests per minute in dev, 10 in production
if (!checkRateLimit(ip, 10, 60 * 1000)) { const maxRequests = process.env.NODE_ENV === 'development' ? 100 : 10;
if (!checkRateLimit(ip, maxRequests, 60 * 1000)) {
return NextResponse.json( return NextResponse.json(
{ {
error: 'Too many requests. Please try again later.', error: 'Too many requests. Please try again later.',
@ -101,8 +102,8 @@ export async function middleware(request: NextRequest) {
} }
// Check authentication for protected routes // Check authentication for protected routes
// Better Auth sets a session cookie - check for its presence // Custom auth sets a session_token cookie - check for its presence
const sessionCookie = request.cookies.get('better-auth.session_token'); const sessionCookie = request.cookies.get('session_token');
if (!sessionCookie) { if (!sessionCookie) {
// Redirect to login if not authenticated // Redirect to login if not authenticated