2 Commits

Include renames

Author	SHA1	Message	Date
Paul NothaftandPaul Nothaft	9bbdca9fc5	docs(security): correct the rate limiter defaults and how they are set (#1336) ... * docs(security): correct the rate limiter defaults and how they are set SECURITY_LOGGING.md said rate_limit_max_requests defaults to 1000 and that the settings are configurable via the admin panel. The code fallback when no app_settings row exists is 300 (19e125d8), a fresh install has no row, and there is no admin screen: the settings are written by PUT /api/admin/settings/security/rate-limit, which nothing in the frontend calls. The reporter of issue 1287 ran on the 300 default without any way to see it. The table now carries the real defaults, what the auth budget counts, the exemptions including the gallery-image one from v3.127.0-beta.0, and the TRUST_PROXY and shared-NAT caveats. Relates to issue 1287 * docs(security): note the rate-limit route only updates existing rows --------- Co-authored-by: Paul Nothaft <[email protected]>	2026-09-07 16:35:13 +02:00
paulandClaude	1773ed5f95	Initial commit - Project start (July 17, 2025) ... Original: feat: enhance security logging and ensure rate limit blocks are properly tracked - Add comprehensive logging for rate limit blocks with full request details - IP address (with proper proxy detection), user agent, headers, timestamps - Rate limit info (current count, limit, remaining, reset time) - Separate tracking for auth vs general endpoints - Enhance authentication failure logging - JWT validation failures with detailed error info - Admin auth attempts without token - Failed token validation with user context - All events include IP, path, method, user agent - Improve Winston logger configuration for production - Add automatic log rotation (10MB errors, 50MB combined) - Create separate security.log for auth/rate limit events - Ensure logs directory exists automatically - Add structured JSON format for log aggregation - Support container logging with LOG_TO_CONSOLE env var - Create comprehensive documentation - Security logging guide with examples - Monitoring recommendations - Configuration reference - Add test script to verify logging functionality All rate limit settings remain configurable via admin panel: - Window duration, max requests, auth limits - Skip authenticated requests option - Public endpoints only option 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <[email protected]>	2025-07-24 16:57:07 +02:00