next-ai-draw-io

i/next-ai-draw-io

Fork 0

mirror of https://github.com/DayuanJiang/next-ai-draw-io.git synced 2026-10-06 09:47:49 +08:00

Author	SHA1	Message	Date
Dayuan Jiang	18a20aa1ca	feat(api): count the quota by the CDN's client IP and refuse direct calls (#956 ) Two optional settings for deployments behind a CDN such as Cloudflare. CLIENT_IP_HEADER names the header that holds the visitor's real IP (cf-connecting-ip on Cloudflare). The per-IP daily quota used the first X-Forwarded-For entry, which visitors can set to anything, so a made-up IP on every request got a fresh quota. ORIGIN_SECRET makes proxy.ts refuse /api requests whose X-Origin-Secret header does not match. The CDN adds the header, so a call that skips the CDN, and could fake the IP header, gets 403. Pages are not checked, which keeps health checks on / working. Both are unset by default, and nothing changes then.	2026-10-06 10:32:43 +09:00

Author

SHA1

Message

Date

Dayuan Jiang

18a20aa1ca

feat(api): count the quota by the CDN's client IP and refuse direct calls (#956 )

Two optional settings for deployments behind a CDN such as Cloudflare.

CLIENT_IP_HEADER names the header that holds the visitor's real IP
(cf-connecting-ip on Cloudflare). The per-IP daily quota used the first
X-Forwarded-For entry, which visitors can set to anything, so a made-up
IP on every request got a fresh quota.

ORIGIN_SECRET makes proxy.ts refuse /api requests whose X-Origin-Secret
header does not match. The CDN adds the header, so a call that skips the
CDN, and could fake the IP header, gets 403. Pages are not checked, which
keeps health checks on / working.

Both are unset by default, and nothing changes then.

2026-10-06 10:32:43 +09:00

Compare commits

Diff Content Not Available