@remit/auth-service 0.0.3 → 0.0.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/package.json +1 -1
- package/src/auth.ts +9 -0
package/package.json
CHANGED
package/src/auth.ts
CHANGED
|
@@ -104,6 +104,15 @@ export const createAuth = async (
|
|
|
104
104
|
window: intEnv("BETTER_AUTH_RATE_LIMIT_SIGN_UP_WINDOW", 60),
|
|
105
105
|
max: intEnv("BETTER_AUTH_RATE_LIMIT_SIGN_UP_MAX", 5),
|
|
106
106
|
},
|
|
107
|
+
// The token endpoint is the hot path: it is polled per session, per
|
|
108
|
+
// tab, and on every page load, so it needs a far higher ceiling than
|
|
109
|
+
// a generic auth route. The global bucket keyed by IP otherwise
|
|
110
|
+
// throttles a legitimate browser — several tabs, or a NAT'd office —
|
|
111
|
+
// and a throttled mint strands the session in a 401 cascade.
|
|
112
|
+
"/token": {
|
|
113
|
+
window: intEnv("BETTER_AUTH_RATE_LIMIT_TOKEN_WINDOW", 60),
|
|
114
|
+
max: intEnv("BETTER_AUTH_RATE_LIMIT_TOKEN_MAX", 300),
|
|
115
|
+
},
|
|
107
116
|
},
|
|
108
117
|
},
|
|
109
118
|
user: { modelName: "auth_user" },
|