parththakkar106andClaude Opus 4.8
c500203270
The per-IP rate limits could be bypassed entirely: uvicorn ran with --forwarded-allow-ips "*", which trusts the leftmost X-Forwarded-For value (client-controlled), and Render forwards the inbound header rather than stripping it. Rotating the header handed out a fresh rate-limit bucket per request, so the login/register limit (10/5min) and guest-minting limit (30/5min) were no throttle at all — unbounded password guessing and guest-row creation. Confirmed live: fixed IP -> 429 after 10; rotating spoofed header -> no 429 across 14 attempts. Two-layer fix: - limits._client_ip now derives the client IP from the hop the trusted edge appends (rightmost of X-Forwarded-For), which a client can't spoof past; tunable via AIDND_TRUSTED_PROXY_HOPS. Dropped --forwarded-allow-ips "*". - New per-account login throttle (email-keyed, 8 fails / 15 min, cleared on success): stops distributed guessing against one account that a per-IP limit can't, since it can't be diluted across many source addresses. Also close an SSRF on the BYOK endpoint_url (hosted mode only): the connection test and turn/chat streams now refuse a URL that resolves to a non-public address (private/loopback/link-local metadata/reserved), checked at request time so it resists a DNS record flipping to a private IP. No-op locally, where reaching localhost Ollama is intended. Tests: test_ratelimit_hardening.py (8), test_netguard.py (13). 172 pass. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015CYEJKobJ2Re4Dv7qUoSA7
47 lines
1.9 KiB
Docker
47 lines
1.9 KiB
Docker
# Stage 1 — build the React SPA. Node 24: package-lock.json is written by
|
|
# npm 11, which older bundled npms (node 22's 10.x) refuse as out-of-sync.
|
|
FROM node:24-alpine AS frontend-build
|
|
WORKDIR /build
|
|
COPY frontend/package.json frontend/package-lock.json ./
|
|
RUN npm ci
|
|
COPY frontend/ ./
|
|
RUN npm run build
|
|
|
|
# Stage 2 — build Python wheels (quickjs compiles from source if no wheel
|
|
# matches, so keep the toolchain out of the final image)
|
|
FROM python:3.12-slim AS python-build
|
|
RUN apt-get update && apt-get install -y --no-install-recommends gcc make \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
COPY backend/requirements.txt /tmp/requirements.txt
|
|
RUN pip wheel --no-cache-dir -r /tmp/requirements.txt -w /wheels
|
|
|
|
# Stage 3 — runtime
|
|
FROM python:3.12-slim
|
|
WORKDIR /app
|
|
|
|
COPY --from=python-build /wheels /wheels
|
|
RUN pip install --no-cache-dir /wheels/* && rm -rf /wheels
|
|
|
|
# Layout mirrors the repo: main.py finds the SPA at ../../frontend/dist
|
|
# relative to backend/app/main.py.
|
|
COPY backend/app /app/backend/app
|
|
COPY --from=frontend-build /build/dist /app/frontend/dist
|
|
|
|
# Database lives on a volume; parent dir is created by the app if missing.
|
|
ENV AIDND_DB_PATH=/data/data.db
|
|
VOLUME /data
|
|
|
|
EXPOSE 8000
|
|
WORKDIR /app/backend
|
|
# --proxy-headers lets uvicorn fix up the request scheme (https) behind the
|
|
# platform's edge. We deliberately do NOT pass --forwarded-allow-ips "*": that
|
|
# made uvicorn trust the LEFTMOST X-Forwarded-For value, which the client fully
|
|
# controls, so anyone could rotate the header to dodge the per-IP rate limits.
|
|
# The client IP used for rate limiting is derived in limits._client_ip from the
|
|
# hop the edge appends (rightmost), which a client cannot spoof past; tune with
|
|
# AIDND_TRUSTED_PROXY_HOPS if the platform adds more proxy hops.
|
|
# Single worker on purpose: the turn lock, rate limiter, and debug log are
|
|
# in-process state.
|
|
CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000", \
|
|
"--proxy-headers"]
|