1 Commits

Author SHA1 Message Date
Asish Kumar def82d4d5e fix(backend-defaults): use ipKeyGenerator for rate limiter keys
The built-in rate limiter derived its key directly from `req.ip`, which
express-rate-limit 8.x rejects with an ERR_ERL_KEY_GEN_IPV6 validation
error. A raw IPv6 address used as a rate limiting key would let a client
bypass the limit by rotating through addresses in its allotted block, so
the library now requires its `ipKeyGenerator` helper to normalize the
address. Wrap the resolved client address in that helper so the limiter
starts cleanly and groups IPv6 clients by their address block.

Signed-off-by: Asish Kumar <officialasishkumar@gmail.com>
2026-05-25 05:21:28 +05:30