apply security fix

2026-07-19 22:22:33 -04:00
parent ec03e783e5
commit a010ad6811
41 changed files with 626 additions and 224 deletions
@@ -92,6 +92,17 @@ export const publicLimiter = rateLimit({
  message: { error: 'too_many_requests', message: 'Rate limit exceeded', statusCode: 429 },
 })

+// Dedicated limiter for public payment/subscription webhooks. Provider retries
+// still fit under this limit, but spray-and-pray signature attempts do not.
+export const webhookLimiter = rateLimit({
+  windowMs: 60 * 1000,
+  max: 30,
+  standardHeaders: 'draft-7',
+  legacyHeaders: false,
+  keyGenerator: (req) => getClientIpKey(req),
+  message: { error: 'too_many_requests', message: 'Webhook rate limit exceeded', statusCode: 429 },
+})
+
 // Tight limiter for admin endpoints
 export const adminLimiter = rateLimit({
  windowMs: 15 * 60 * 1000,