fix: simplify login identifier construction in two-factor recovery and token handling

This commit is contained in:
shuaiplus
2026-05-23 02:22:04 +08:00
parent d468745841
commit 18eefd1174
2 changed files with 2 additions and 2 deletions
+1 -1
View File
@@ -731,7 +731,7 @@ export async function handleRecoverTwoFactor(request: Request, env: Env): Promis
if (!clientIdentifier) {
return errorResponse('Client IP is required', 403);
}
const recoverLimitKey = `${clientIdentifier}:recover-2fa:${email || 'unknown'}`;
const recoverLimitKey = `${clientIdentifier}:recover-2fa`;
const recoverAttemptCheck = await rateLimit.checkLoginAttempt(recoverLimitKey);
if (!recoverAttemptCheck.allowed) {