3 Commits

Author	SHA1	Message	Date
paul	657e74a2e3	fix: resolve duplicate logger declaration and syntax error in rate limit service ... - Remove duplicate logger import in server.js (line 26) - Fix missing closing bracket in rateLimitService.js headers object - Ensure backend starts without syntax errors 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>	2025-07-18 20:41:59 +02:00
paul	f6e5a454ae	feat: enhance security logging and ensure rate limit blocks are properly tracked ... - Add comprehensive logging for rate limit blocks with full request details - IP address (with proper proxy detection), user agent, headers, timestamps - Rate limit info (current count, limit, remaining, reset time) - Separate tracking for auth vs general endpoints - Enhance authentication failure logging - JWT validation failures with detailed error info - Admin auth attempts without token - Failed token validation with user context - All events include IP, path, method, user agent - Improve Winston logger configuration for production - Add automatic log rotation (10MB errors, 50MB combined) - Create separate security.log for auth/rate limit events - Ensure logs directory exists automatically - Add structured JSON format for log aggregation - Support container logging with LOG_TO_CONSOLE env var - Create comprehensive documentation - Security logging guide with examples - Monitoring recommendations - Configuration reference - Add test script to verify logging functionality All rate limit settings remain configurable via admin panel: - Window duration, max requests, auth limits - Skip authenticated requests option - Public endpoints only option 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>	2025-07-18 19:25:42 +02:00
paul	9d0607f4f0	feat: implement dynamic rate limiting with database configuration ... - Add database migration for rate limit settings - Create rate limit service with dynamic configuration from database - Implement proper authentication detection for admin and gallery tokens - Skip rate limiting for authenticated users (configurable) - Add admin API endpoint to update rate limit settings - Use correct client IP detection with proxy support - Cache settings for performance (1 minute cache) - Default to 1000 requests per 15 minutes for better UX - Apply auth-specific limits only to login endpoints Key improvements: - No more rate limiting for authenticated gallery/admin users - Configurable via admin settings page - Immediate effect when settings change - Better handling of proxied requests 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>	2025-07-17 08:43:44 +02:00