fix(security): harden auth and request limits

2026-08-05 06:50:10 +00:00 · 2026-07-05 23:43:49 +08:00
parent 12af18e3a3
commit d9a36fefe6
12 changed files with 315 additions and 30 deletions
@@ -465,6 +465,8 @@ export async function handlePublicRoute(
  }

  if ((path === '/identity/accounts/recover-2fa' || path === '/api/accounts/recover-2fa') && method === 'POST') {
+    const blocked = await enforcePublicRateLimit('public-sensitive', LIMITS.rateLimit.sensitivePublicRequestsPerMinute);
+    if (blocked) return blocked;
    return handleRecoverTwoFactor(request, env);
  }