mirror of
https://github.com/danny-avila/LibreChat.git
synced 2026-03-22 07:36:33 +01:00
ecd6d76bc8
* fix: Add removePorts keyGenerator to all IP-based rate limiters Six IP-based rate limiters are missing the `keyGenerator: removePorts` option that is already used by the auth-related limiters (login, register, resetPassword, verifyEmail). Without it, reverse proxies that include ports in X-Forwarded-For headers cause ERR_ERL_INVALID_IP_ADDRESS errors from express-rate-limit. Fixes #12318 * fix: make removePorts IPv6-safe to prevent rate-limit key collisions The original regex `/:\d+[^:]*$/` treated the last colon-delimited segment of bare IPv6 addresses as a port, mangling valid IPs (e.g. `::1` → `::`, `2001:db8::1` → `2001:db8::`). Distinct IPv6 clients could collapse into the same rate-limit bucket. Use `net.isIP()` as a fast path for already-valid IPs, then match bracketed IPv6+port and IPv4+port explicitly. Bare IPv6 addresses are now returned unchanged. Also fixes pre-existing property ordering inconsistency in ttsLimiters.js userLimiterOptions (keyGenerator before store). * refactor: move removePorts to packages/api as TypeScript, fix import order - Move removePorts implementation to packages/api/src/utils/removePorts.ts with proper Express Request typing - Reduce api/server/utils/removePorts.js to a thin re-export from @librechat/api for backward compatibility - Consolidate removePorts import with limiterCache from @librechat/api in all 6 limiter files, fixing import order (package imports shortest to longest, local imports longest to shortest) - Remove narrating inline comments per code style guidelines --------- Co-authored-by: Danny Avila <danny@librechat.ai>
86 lines
2.8 KiB
JavaScript
86 lines
2.8 KiB
JavaScript
const { logger } = require('@librechat/data-schemas');
|
|
const { ViolationTypes } = require('librechat-data-provider');
|
|
const { isEnabled, math, removePorts } = require('@librechat/api');
|
|
const { deleteAllUserSessions } = require('~/models');
|
|
const getLogStores = require('./getLogStores');
|
|
|
|
const { BAN_VIOLATIONS, BAN_INTERVAL } = process.env ?? {};
|
|
const interval = math(BAN_INTERVAL, 20);
|
|
|
|
/**
|
|
* Bans a user based on violation criteria.
|
|
*
|
|
* If the user's violation count is a multiple of the BAN_INTERVAL, the user will be banned.
|
|
* The duration of the ban is determined by the BAN_DURATION environment variable.
|
|
* If BAN_DURATION is not set or invalid, the user will not be banned.
|
|
* Sessions will be deleted and the refreshToken cookie will be cleared even with
|
|
* an invalid or nill duration, which is a "soft" ban; the user can remain active until
|
|
* access token expiry.
|
|
*
|
|
* @async
|
|
* @param {Object} req - Express request object containing user information.
|
|
* @param {Object} res - Express response object.
|
|
* @param {Object} errorMessage - Object containing user violation details.
|
|
* @param {string} errorMessage.type - Type of the violation.
|
|
* @param {string} errorMessage.user_id - ID of the user who committed the violation.
|
|
* @param {number} errorMessage.violation_count - Number of violations committed by the user.
|
|
*
|
|
* @returns {Promise<void>}
|
|
*
|
|
*/
|
|
const banViolation = async (req, res, errorMessage) => {
|
|
if (!isEnabled(BAN_VIOLATIONS)) {
|
|
return;
|
|
}
|
|
if (!errorMessage) {
|
|
return;
|
|
}
|
|
|
|
const { type, user_id, prev_count, violation_count } = errorMessage;
|
|
|
|
const prevThreshold = Math.floor(prev_count / interval);
|
|
const currentThreshold = Math.floor(violation_count / interval);
|
|
|
|
if (prevThreshold >= currentThreshold) {
|
|
return;
|
|
}
|
|
|
|
await deleteAllUserSessions({ userId: user_id });
|
|
|
|
/** Clear OpenID session tokens if present */
|
|
if (req.session?.openidTokens) {
|
|
delete req.session.openidTokens;
|
|
}
|
|
|
|
res.clearCookie('refreshToken');
|
|
res.clearCookie('openid_access_token');
|
|
res.clearCookie('openid_id_token');
|
|
res.clearCookie('openid_user_id');
|
|
res.clearCookie('token_provider');
|
|
|
|
const banLogs = getLogStores(ViolationTypes.BAN);
|
|
const duration = errorMessage.duration || banLogs.opts.ttl;
|
|
if (duration <= 0) {
|
|
return;
|
|
}
|
|
|
|
req.ip = removePorts(req);
|
|
logger.info(
|
|
`[BAN] Banning user ${user_id} ${req.ip ? `@ ${req.ip} ` : ''}for ${
|
|
duration / 1000 / 60
|
|
} minutes`,
|
|
);
|
|
|
|
const expiresAt = Date.now() + duration;
|
|
await banLogs.set(user_id, { type, violation_count, duration, expiresAt });
|
|
if (req.ip) {
|
|
await banLogs.set(req.ip, { type, user_id, violation_count, duration, expiresAt });
|
|
}
|
|
|
|
errorMessage.ban = true;
|
|
errorMessage.ban_duration = duration;
|
|
|
|
return;
|
|
};
|
|
|
|
module.exports = banViolation;
|