fix(auth): 移除共享 IP 限流中间件，避免正常登录被误拦截 - #325
Open
xiaocheny214 wants to merge 1 commit into
Open
Conversation
RateLimitMiddleware 把登录/注册/发码等认证动作和普通 API 都按 IP 计入同一组桶，共享出口 IP 和页面流量会把正常登录误拦成 429。账号级错误密码锁定和发码冷却仍保留。 Fixes 1024XEngineer#292 Co-authored-by: Cursor <cursoragent@cursor.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub. |
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
![fennoai[bot]](https://avatars.githubusercontent.com/in/1924301?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
本次检查了固定提交范围 10798cb76cb7832089ed1265ee1cdbf7ca3f6bb7...27e63275527dfaf2fb98ab792865c325e95dbc87，重点覆盖应用中间件装配、认证白名单、账号级登录失败锁定和验证码冷却。移除 RateLimitMiddleware 后没有发现残留导入或会破坏现有认证流程的变更；按 issue #292 约定，粗粒度限流由外部 nginx 网关承担，因此没有可提交的代码审查问题。
已验证：git diff --check、相关 Python 文件语法编译、删除模块的全仓库引用检查均通过。环境未安装 uv 或 pytest，因此未能运行测试套件和 import-linter。
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
RateLimitMiddleware及其在create_app中的装配。该中间件把/auth/login、/auth/register、/auth/send-code等认证动作和普通 API 都按 IP 计入同一组 Redis 桶，共享出口 IP 或页面流量会把正确密码登录误拦成 429。AuthMiddleware之前，实际上拿不到user_id，声明的 120 次/分钟从未生效。Fixes #292
变更
backend/packages/app/src/windup_app/web/middleware/ratelimit.pycreate_app不再注册RateLimitMiddleware；请求路径变为 CORS → Auth → 路由Test plan
create_app()可正常装配/auth/send-code单邮箱 60 秒冷却仍生效Made with Cursor