popertots/Crussell
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(main): add request body size limits to API routes

Browse Source 
Add limitBody(defaultBodyLimit) middleware to register, login, verify, booking, guest user, and admin routes.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>
This commit is contained in:
popertots
2026-05-31 18:48:57 +01:00
co-authored by Sisyphus
parent 306f942d00
commit 253d8785a4
1 changed files with 7 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/main.go
+7 -5
View File
@@ -159,14 +159,14 @@ func main() {
}) })
// Registration: 10/min to prevent spam // Registration: 10/min to prevent spam
r.With(mw.RateLimit(10, time.Minute)).Post("/register", authHandlers.RegisterHandler) r.With(mw.RateLimit(10, time.Minute), limitBody(defaultBodyLimit)).Post("/register", authHandlers.RegisterHandler)
// Login: Has its own internal rate limiting // Login: Has its own internal rate limiting
r.With(mw.RateLimit(10, time.Minute)).Post("/login", authHandlers.LoginHandler) r.With(mw.RateLimit(10, time.Minute), limitBody(defaultBodyLimit)).Post("/login", authHandlers.LoginHandler)
// Email verification // Email verification
r.With(mw.RateLimit(10, time.Minute)).Post("/verify/generate", authHandlers.GenerateVerificationCodeHandler) r.With(mw.RateLimit(10, time.Minute), limitBody(defaultBodyLimit)).Post("/verify/generate", authHandlers.GenerateVerificationCodeHandler)
r.With(mw.RateLimit(20, time.Minute)).Post("/verify/check", authHandlers.VerifyCodeHandler) r.With(mw.RateLimit(20, time.Minute), limitBody(defaultBodyLimit)).Post("/verify/check", authHandlers.VerifyCodeHandler)
// Health check // Health check
r.Get("/health", healthCheckHandler) r.Get("/health", healthCheckHandler)
@@ -213,12 +213,13 @@ func main() {
// Public booking endpoints (optional auth for slot reservation and guest bookings) // Public booking endpoints (optional auth for slot reservation and guest bookings)
r.Group(func(r chi.Router) { r.Group(func(r chi.Router) {
r.Use(mw.RateLimit(30, time.Minute), mw.OptionalAuth) r.Use(mw.RateLimit(30, time.Minute), mw.OptionalAuth)
r.Use(limitBody(defaultBodyLimit))
r.Post("/bookings/reserve", bookings.ReserveSlotHandler) r.Post("/bookings/reserve", bookings.ReserveSlotHandler)
r.Post("/bookings", bookings.CreateBookingHandler) r.Post("/bookings", bookings.CreateBookingHandler)
}) })
// Guest user creation (public, no auth required) // Guest user creation (public, no auth required)
r.With(mw.RateLimit(10, time.Minute)).Post("/users/guest", user.CreateGuestUserHandler) r.With(mw.RateLimit(10, time.Minute), limitBody(defaultBodyLimit)).Post("/users/guest", user.CreateGuestUserHandler)
// Authenticated users // Authenticated users
r.Group(func(r chi.Router) { r.Group(func(r chi.Router) {
@@ -261,6 +262,7 @@ func main() {
r.Group(func(r chi.Router) { r.Group(func(r chi.Router) {
r.Use(mw.RequireAuth) r.Use(mw.RequireAuth)
r.Use(mw.RequireAdmin) r.Use(mw.RequireAdmin)
r.Use(limitBody(defaultBodyLimit))
r.Route("/admin/services", func(r chi.Router) { r.Route("/admin/services", func(r chi.Router) {
r.Post("/", services.CreateServiceHandler) r.Post("/", services.CreateServiceHandler)