openclawd/docfast
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Security fixes: non-root user, signup rate limiting, differentiated CORS, persistent usage tracking

Browse source
This commit is contained in:
OpenClaw 2026-02-14 17:04:55 +00:00
parent 6a38ba4adc
commit 73bb041513
5 changed files with 108 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

17
src/routes/signup.ts
View file

@ -1,10 +1,25 @@
import { Router, Request, Response } from "express";
import rateLimit from "express-rate-limit";
import { createFreeKey } from "../services/keys.js";
const router = Router();
// Rate limiting for signup - 5 signups per IP per hour
const signupLimiter = rateLimit({
windowMs: 60 * 60 * 1000, // 1 hour
max: 5, // 5 signups per IP per hour
message: {
error: "Too many signup attempts. Please try again in 1 hour.",
retryAfter: "1 hour"
},
standardHeaders: true,
legacyHeaders: false,
skipSuccessfulRequests: false,
skipFailedRequests: false,
});
// Self-service free API key signup
router.post("/free", (req: Request, res: Response) => {
router.post("/free", signupLimiter, (req: Request, res: Response) => {
const { email } = req.body;
if (!email || typeof email !== "string") {