dmitry.galkin/chatbot-template
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(chat): add ip-based rate limiting to prevent session rotation abuse (#1436)

Browse source
This commit is contained in:
dancer 2026-03-02 14:00:40 +00:00 • committed by GitHub
parent 211cb96a96
commit ad47aa0ee0
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
7 changed files with 87 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

12
app/(chat)/api/chat/route.ts
View file

@ -1,4 +1,5 @@
import { geolocation } from "@vercel/functions";
import { checkBotId } from "botid/server";
import { geolocation, ipAddress } from "@vercel/functions";
import {
convertToModelMessages,
createUIMessageStream,
@ -31,6 +32,7 @@ import {
} from "@/lib/db/queries";
import type { DBMessage } from "@/lib/db/schema";
import { ChatbotError } from "@/lib/errors";
import { checkIpRateLimit } from "@/lib/ratelimit";
import type { ChatMessage } from "@/lib/types";
import { convertToUIMessages, generateUUID } from "@/lib/utils";
import { generateTitleFromUserMessage } from "../../actions";
@ -62,12 +64,18 @@ export async function POST(request: Request) {
const { id, message, messages, selectedChatModel, selectedVisibilityType } =
requestBody;
const session = await auth();
const [botResult, session] = await Promise.all([checkBotId(), auth()]);
if (botResult.isBot) {
return new ChatbotError("unauthorized:chat").toResponse();
}
if (!session?.user) {
return new ChatbotError("unauthorized:chat").toResponse();
}
await checkIpRateLimit(ipAddress(request));
const userType: UserType = session.user.type;
const messageCount = await getMessageCountByUserId({