fix: validate anonymous notification hub requests

2026-08-05 06:50:10 +00:00 · 2026-07-06 15:38:52 +08:00
parent ae168bea31
commit 23c53bd1af
2 changed files with 10 additions and 0 deletions
@@ -549,6 +549,8 @@ export async function handlePublicRoute(
  }

  if (path === '/notifications/anonymous-hub' && method === 'GET') {
+    const blocked = await enforcePublicRateLimit('public-sensitive', LIMITS.rateLimit.sensitivePublicRequestsPerMinute);
+    if (blocked) return blocked;
    return handleAnonymousNotificationsHub(request, env);
  }
  return null;