Skip to content

fix: harden contact backend rate limiting - #33

Merged
kamycoding merged 1 commit into
mainfrom
fix/contact-backend-production
Aug 11, 2026
Merged

fix: harden contact backend rate limiting#33
kamycoding merged 1 commit into
mainfrom
fix/contact-backend-production

Conversation

@kamycoding

Copy link
Copy Markdown
Owner

No description provided.

Copilot AI lite review requested due to automatic review settings August 11, 2026 18:50
@netlify

netlify Bot commented Aug 11, 2026

Copy link
Copy Markdown

Deploy Preview for fanciful-cannoli-268c0c ready!

Name Link
🔨 Latest commit 30ad5d2
🔍 Latest deploy log https://app.netlify.com/projects/fanciful-cannoli-268c0c/deploys/6a7b6f16e7423900070f1a59
😎 Deploy Preview https://deploy-preview-33--fanciful-cannoli-268c0c.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.
🤖 Make changes Run an agent on this branch

To edit notification comments on pull requests, go to your Netlify project configuration.

@kamycoding
kamycoding merged commit 5848903 into main Aug 11, 2026
5 checks passed

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR strengthens the /api/contact rate limiting behavior to avoid client-controlled forwarded headers influencing rate-limit identity, and extends integration coverage for additional failure and endpoint-isolation scenarios.

Changes:

  • Configure Express to not trust proxy headers and use a socket-based IP key generator for contact rate limiting.
  • Extend contact integration tests to cover an additional email delivery failure category (network).
  • Add integration tests ensuring rate limiting ignores x-forwarded-for and that /api/health remains unaffected by contact delivery failures.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File Description
server/src/app.ts Hardens rate limiting identity by ignoring forwarded headers and generating keys from the peer socket address.
server/test/contact.integration.test.ts Adds/extends integration tests for the hardened rate limiting behavior and endpoint isolation.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants