Graham McIntire
fb34553fe9
- Updated IP geolocation to check CF-Connecting-IP header first - Added support for X-Real-IP header as additional fallback - Updated rate limiter to use same header priority for consistency - Headers checked in order: CF-Connecting-IP > X-Forwarded-For > X-Real-IP > remote_ip This ensures proper client IP detection when the site is behind Cloudflare. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>
76 lines
1.7 KiB
Elixir
76 lines
1.7 KiB
Elixir
defmodule AprsmeWeb.Plugs.RateLimiter do
|
|
@moduledoc """
|
|
Rate limiting plug to prevent DoS attacks
|
|
"""
|
|
import Phoenix.Controller
|
|
import Plug.Conn
|
|
|
|
def init(opts) do
|
|
# Default options
|
|
Keyword.merge(
|
|
[
|
|
# 1 minute
|
|
scale: 60_000,
|
|
# 100 requests per minute
|
|
limit: 100,
|
|
# Rate limit by IP address
|
|
key: :ip,
|
|
error_message: "Too many requests"
|
|
],
|
|
opts
|
|
)
|
|
end
|
|
|
|
def call(conn, opts) do
|
|
key = get_key(conn, opts[:key])
|
|
scale = opts[:scale]
|
|
limit = opts[:limit]
|
|
error_message = opts[:error_message]
|
|
|
|
case Aprsme.RateLimiter.hit("rate_limit:#{key}", scale, limit) do
|
|
{:allow, _count} ->
|
|
conn
|
|
|
|
{:deny, _retry_after} ->
|
|
conn
|
|
|> put_status(:too_many_requests)
|
|
|> json(%{error: error_message})
|
|
|> halt()
|
|
end
|
|
end
|
|
|
|
defp get_key(conn, :ip) do
|
|
# Check headers in order of preference
|
|
cond do
|
|
# Cloudflare header takes precedence
|
|
cf_ip = get_req_header(conn, "cf-connecting-ip") != [] ->
|
|
hd(cf_ip)
|
|
|
|
# Then standard forwarded headers
|
|
forwarded = get_req_header(conn, "x-forwarded-for") != [] ->
|
|
forwarded |> hd() |> String.split(",") |> List.first() |> String.trim()
|
|
|
|
real_ip = get_req_header(conn, "x-real-ip") != [] ->
|
|
hd(real_ip)
|
|
|
|
# Fall back to remote_ip
|
|
true ->
|
|
conn.remote_ip |> :inet.ntoa() |> to_string()
|
|
end
|
|
end
|
|
|
|
defp get_key(conn, :user_agent) do
|
|
case get_req_header(conn, "user-agent") do
|
|
[ua | _] -> ua
|
|
[] -> "unknown"
|
|
end
|
|
end
|
|
|
|
defp get_key(conn, custom_key) when is_function(custom_key) do
|
|
custom_key.(conn)
|
|
end
|
|
|
|
defp get_key(_conn, key) when is_binary(key) do
|
|
key
|
|
end
|
|
end
|