From e5e80de0cfade3fea5f8d2a2a9ca6a603db5d7a4 Mon Sep 17 00:00:00 2001 From: dujiao-next Date: Sun, 11 Oct 2026 13:22:20 +0800 Subject: [PATCH] =?UTF-8?q?fix:=20=E6=B3=A8=E5=86=8C/=E5=BF=98=E8=AE=B0?= =?UTF-8?q?=E5=AF=86=E7=A0=81/=E5=8F=91=E9=80=81=E9=AA=8C=E8=AF=81?= =?UTF-8?q?=E7=A0=81=E9=99=90=E6=B5=81=E6=94=BE=E5=AE=BD=E4=B8=BA=E7=8B=AC?= =?UTF-8?q?=E7=AB=8B=E5=8F=82=E6=95=B0=EF=BC=8C=E9=81=BF=E5=85=8D=E5=85=B1?= =?UTF-8?q?=E4=BA=AB=20IP=20=E7=94=A8=E6=88=B7=E8=A2=AB=E6=88=90=E6=89=B9?= =?UTF-8?q?=E8=AF=AF=E5=B0=81?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- internal/app/httpserver/routes_storefront.go | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/internal/app/httpserver/routes_storefront.go b/internal/app/httpserver/routes_storefront.go index fb04f651..471849ac 100644 --- a/internal/app/httpserver/routes_storefront.go +++ b/internal/app/httpserver/routes_storefront.go @@ -99,10 +99,15 @@ func registerStorefrontRoutes( paymenttransport.RegisterGuestWriteRoutes(guestWrite, paymentWriteHandler) } - // 注册 / 忘记密码 / 发送验证码：沿用登录限流参数，独立计数并使用通用提示 - authRule := loginRule - authRule.Prefix += ":auth" - authRule.MessageKey = "error.rate_limited" + // 注册 / 忘记密码 / 发送验证码：按 IP 计数，共享出口 IP（NAT）下一次完整流程就要 2~4 次请求， + // 不能照搬登录的 5 次/封 15 分钟，否则同网用户会被成批误封。 + authRule := middleware.RateLimitRule{ + Prefix: loginRule.Prefix + ":auth", + WindowSeconds: 300, + MaxRequests: 20, + BlockSeconds: 300, + MessageKey: "error.rate_limited", + } authRateLimit := middleware.RateLimitMiddleware(redisClient, authRule, middleware.KeyByIP) // 用户认证接口