From f081a7fdc1dfd47795b5d838b2d4ec64f7bc4bd9 Mon Sep 17 00:00:00 2001
From: advplyr <advplyr@protonmail.com>
Date: Sat, 12 Jul 2025 10:32:35 -0500
Subject: [PATCH] Update rate limiter to use requestIp as key, pass in
 configurable error message

---
 server/utils/rateLimiterFactory.js | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/server/utils/rateLimiterFactory.js b/server/utils/rateLimiterFactory.js
index b5199662..0ad77406 100644
--- a/server/utils/rateLimiterFactory.js
+++ b/server/utils/rateLimiterFactory.js
@@ -1,5 +1,6 @@
 const { rateLimit, RateLimitRequestHandler } = require('express-rate-limit')
 const Logger = require('../Logger')
+const requestIp = require('../libs/requestIp')
 
 /**
  * Factory for creating authentication rate limiters
@@ -28,7 +29,7 @@ class RateLimiterFactory {
       max = parseInt(process.env.RATE_LIMIT_AUTH_MAX)
     }
 
-    let message = 'Too many requests, please try again later.'
+    let message = 'Too many authentication requests'
     if (process.env.RATE_LIMIT_AUTH_MESSAGE) {
       message = process.env.RATE_LIMIT_AUTH_MESSAGE
     }
@@ -36,18 +37,22 @@ class RateLimiterFactory {
     this.authRateLimiter = rateLimit({
       windowMs,
       max,
-      message,
       standardHeaders: true,
       legacyHeaders: false,
+      keyGenerator: (req) => {
+        // Override keyGenerator to handle proxy IPs
+        return requestIp.getClientIp(req) || req.ip
+      },
       handler: (req, res) => {
         const userAgent = req.get('User-Agent') || 'Unknown'
         const endpoint = req.path
         const method = req.method
+        const ip = requestIp.getClientIp(req) || req.ip
 
-        Logger.warn(`[RateLimiter] Rate limit exceeded - IP: ${req.ip}, Endpoint: ${method} ${endpoint}, User-Agent: ${userAgent}`)
+        Logger.warn(`[RateLimiter] Rate limit exceeded - IP: ${ip}, Endpoint: ${method} ${endpoint}, User-Agent: ${userAgent}`)
 
         res.status(429).json({
-          error: 'Too many authentication attempts, please try again later.'
+          error: message
         })
       }
     })