admin: per-IP rate limit (5/min) on admin key attempts (#66)

2026-09-09 09:15:01 -05:00
parent 03bf327f6b
commit 9811191648
3 changed files with 91 additions and 0 deletions
@@ -172,6 +172,11 @@ func (a *apiServer) adminKeyOK(r *http.Request, key string) bool {

 func (a *apiServer) adminAuth(next http.HandlerFunc, key string) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
+		if !rateLimitAdmin(r) {
+			log.Printf("admin auth RATE LIMITED: %s %s from %s", r.Method, r.URL.Path, r.RemoteAddr)
+			writeRateLimited(w, 60)
+			return
+		}
 		if !a.adminKeyOK(r, key) {
 			log.Printf("admin auth FAILURE: %s %s from %s", r.Method, r.URL.Path, r.RemoteAddr)
 			writeErr(w, 401, "unauthorized")