shaw
fead4c7ec3
feat(security): add panel API rate limiting to protect DB from high-frequency requests
用户可高频刷面板接口(usage/dashboard 等重聚合查询)直接打爆数据库:
现有限流器只覆盖登录/注册等公开认证入口,登录后的全部面板端点无任何限流。
三层防护(阈值均可在后台可视化配置,panel_rate_limit_settings):
1. 认证面板接口按「用户 ID」限流,与来源 IP 无关——反向代理/NAT 共享出口
(所有请求源地址坍缩为 127.0.0.1 等)不会互相误伤:
- Global 档(默认 240 rpm/账号):user/auth/payment/admin 全部登录后路由
- Heavy 档(默认 60 rpm/账号):/usage、/usage/dashboard/*、
/user/api-keys/:id/usage/daily 等重 SQL 聚合端点叠加计数
- 管理员默认豁免(可关闭)
2. 无认证公开接口(/api/v1/settings/*,每次请求都查 DB)按安全客户端 IP
限流(默认 300 rpm/IP);回环/私网/链路本地地址(反代内部转发地址)
一律跳过计数,杜绝把整条反代链路合并进同一个桶造成大面积误拦截。
3. 修复既有隐患:auth 入口限流的 IP 取值从 c.ClientIP() 切换到与审计日志/
会话绑定/API Key ACL 同源的安全客户端 IP 解析(尊重后台「信任反代转发
IP」开关快照)。原实现下默认反代部署(未配置 server.trusted_proxies)
所有用户共享同一个登录限流桶,既会全员误拦也可被单人恶意占满形成登录
DoS;开关关闭时行为与原来完全一致。
工程约束:
- 配置热路径走进程内缓存(atomic.Value + singleflight,60s TTL),
限流中间件零 DB 访问;保存后当前节点立即生效
- 面板限流 Redis 故障 fail-open(auth 入口保持原有 fail-close)
- 429 响应携带 Retry-After;错误码 RATE_LIMITED
- 支付 webhook / 公开支付回调有意不挂限流
- 新增 GET/PUT /api/v1/admin/settings/panel-rate-limit;设置页安全 tab
新增「面板接口限流」卡片(zh/en i18n 全量)
测试:rate_limiter/panel_rate_limit/setting_panel_rate_limit 单测全绿;
routes、handler/admin、-tags unit 契约测试通过;前端 vue-tsc/ESLint/
SettingsView spec(26/26,含新增交互用例)/i18n 守卫全部通过。
2026-07-27 15:12:51 +08:00
..
2026-07-26 13:43:06 +08:00
2026-07-23 15:50:44 +08:00
2026-07-16 19:57:48 +08:00
2026-07-14 17:05:46 +08:00
2026-07-17 19:15:16 +08:00
2026-07-15 20:30:23 +08:00
2026-07-15 20:30:23 +08:00
2026-07-13 23:32:16 +08:00
2026-07-17 22:10:18 +08:00
2026-07-23 15:50:44 +08:00
2026-07-26 01:56:10 +08:00
2026-07-14 22:31:39 +08:00
2026-07-18 21:05:50 +08:00
2026-07-21 05:02:30 -07:00
2026-07-21 05:02:30 -07:00
2026-07-26 21:04:18 +08:00
2026-07-19 12:17:52 +08:00
2026-07-25 12:50:46 +08:00
2026-07-17 20:59:29 +08:00
2026-07-23 15:50:44 +08:00
2026-07-25 12:50:46 +08:00
2026-07-25 12:50:46 +08:00
2026-07-25 12:50:46 +08:00
2026-07-08 08:49:22 +08:00
2026-07-25 19:40:53 +08:00
2026-07-16 15:37:35 +08:00
2026-07-23 09:19:25 +08:00
2026-07-23 09:19:25 +08:00
2026-07-25 19:40:53 +08:00
2026-07-15 23:58:46 +08:00
2026-07-25 19:40:53 +08:00
2026-07-25 22:20:27 +08:00
2026-07-19 12:17:31 +08:00
2026-07-09 20:06:09 +08:00
2026-07-13 23:32:16 +08:00
2026-07-15 04:28:55 -05:00
2026-07-25 12:50:46 +08:00
2026-07-16 15:37:35 +08:00
2026-07-08 08:49:22 +08:00
2026-07-26 20:23:50 +09:00
2026-07-26 20:23:50 +09:00
2026-07-26 20:23:50 +09:00
2026-07-08 08:49:22 +08:00
2026-07-08 08:49:22 +08:00
2026-07-18 15:35:30 +08:00
2026-07-26 20:23:50 +09:00
2026-07-08 08:49:22 +08:00
2026-07-18 21:43:54 +08:00
2026-07-18 21:43:54 +08:00
2026-07-25 12:50:46 +08:00
2026-07-21 11:16:04 +08:00
2026-07-25 12:50:46 +08:00
2026-07-21 11:02:43 +08:00
2026-07-08 15:51:22 +08:00
2026-07-20 11:15:37 +08:00
2026-07-08 15:26:54 +08:00
2026-07-16 13:47:50 +08:00
2026-07-23 16:43:18 +08:00
2026-07-23 16:43:18 +08:00
2026-07-18 00:11:18 +08:00
2026-07-18 00:11:18 +08:00
2026-07-25 19:40:53 +08:00
2026-07-25 19:40:53 +08:00
2026-07-25 19:40:53 +08:00
2026-07-25 19:40:53 +08:00
2026-07-20 15:20:51 +08:00
2026-07-20 15:20:51 +08:00
2026-07-07 18:53:56 +08:00
2026-07-07 18:53:56 +08:00
2026-07-07 18:53:56 +08:00
2026-07-07 18:53:56 +08:00
2026-07-07 18:53:56 +08:00
2026-07-24 01:22:34 +08:00
2026-07-07 18:53:56 +08:00
2026-07-07 03:31:39 +08:00
2026-07-07 18:53:56 +08:00
2026-07-07 03:31:39 +08:00
2026-07-07 18:53:56 +08:00
2026-07-07 03:31:39 +08:00
2026-07-24 01:22:34 +08:00
2026-07-24 01:22:34 +08:00
2026-07-24 01:22:34 +08:00
2026-07-24 01:22:34 +08:00
2026-07-07 18:53:56 +08:00
2026-07-07 18:53:56 +08:00
2026-07-07 18:53:56 +08:00
2026-07-24 01:22:34 +08:00
2026-07-25 11:22:42 +08:00
2026-07-15 10:03:38 -07:00
2026-07-26 01:56:10 +08:00
2026-07-18 13:53:36 +08:00
2026-07-18 13:53:36 +08:00
2026-07-14 12:24:42 +08:00
2026-07-16 16:30:19 +08:00
2026-07-21 11:55:38 +08:00
2026-07-21 11:55:38 +08:00
2026-07-14 12:24:42 +08:00
2026-07-16 16:30:19 +08:00
2026-07-14 12:24:42 +08:00
2026-07-16 16:30:19 +08:00
2026-07-14 12:24:42 +08:00
2026-07-23 11:18:10 +08:00
2026-07-23 11:18:10 +08:00
2026-07-15 09:35:34 -07:00
2026-07-25 11:22:42 +08:00
2026-07-25 10:20:50 +08:00
2026-07-23 09:20:18 +08:00
2026-07-23 09:20:18 +08:00
2026-07-25 10:20:50 +08:00
2026-07-23 09:20:18 +08:00
2026-07-13 15:32:42 +08:00
2026-07-13 15:32:42 +08:00
2026-07-14 17:39:49 +08:00
2026-07-14 17:39:49 +08:00
2026-07-14 17:39:49 +08:00
2026-07-25 19:40:53 +08:00
2026-07-14 17:39:49 +08:00
2026-07-15 23:58:46 +08:00
2026-07-13 23:32:16 +08:00
2026-07-23 15:50:44 +08:00
2026-07-27 15:12:51 +08:00
2026-07-09 10:03:49 +08:00
2026-07-09 10:03:49 +08:00
2026-07-18 20:41:12 +08:00
2026-07-25 15:37:06 +08:00
2026-07-25 15:37:05 +08:00
2026-07-07 22:14:46 +08:00
2026-07-26 17:54:56 +00:00
2026-07-16 15:45:22 +08:00
2026-07-08 08:49:20 +08:00
2026-07-20 21:00:29 +08:00
2026-07-20 21:00:29 +08:00
2026-07-27 08:19:19 +08:00
2026-07-27 08:19:19 +08:00
2026-07-26 17:54:56 +00:00
2026-07-25 21:59:20 +07:00
2026-07-17 22:10:18 +08:00
2026-07-17 22:10:18 +08:00
2026-07-17 22:10:18 +08:00
2026-07-20 22:43:11 +08:00
2026-07-27 00:43:53 +08:00
2026-07-07 13:53:39 +08:00
2026-07-17 21:59:57 +08:00
2026-07-17 21:59:57 +08:00
2026-07-23 09:20:18 +08:00
2026-07-23 09:20:52 +08:00
2026-07-16 15:45:22 +08:00
2026-07-25 15:37:05 +08:00
2026-07-23 10:26:58 +08:00
2026-07-27 00:43:53 +08:00
2026-07-07 13:41:40 +08:00
2026-07-07 13:41:40 +08:00
2026-07-24 03:00:26 +08:00
2026-07-26 09:52:47 +08:00
2026-07-26 09:52:47 +08:00
2026-07-27 13:19:00 +09:00
2026-07-27 13:40:05 +09:00
2026-07-17 22:10:18 +08:00
2026-07-15 09:40:08 +08:00
2026-07-15 09:40:08 +08:00
2026-07-20 10:40:18 +08:00
2026-07-22 13:32:35 +08:00
2026-07-15 09:40:08 +08:00
2026-07-15 09:40:08 +08:00
2026-07-14 01:09:07 +08:00
2026-07-14 14:55:30 +08:00
2026-07-19 12:17:52 +08:00
2026-07-19 12:17:52 +08:00
2026-07-19 12:17:42 +08:00
2026-07-19 12:17:42 +08:00
2026-07-19 22:40:58 +08:00
2026-07-19 22:40:58 +08:00
2026-07-15 09:40:08 +08:00
2026-07-22 13:32:35 +08:00
2026-07-22 13:32:35 +08:00
2026-07-18 14:37:25 +08:00
2026-07-18 14:37:25 +08:00
2026-07-16 18:18:28 +08:00
2026-07-25 12:50:46 +08:00
2026-07-15 23:58:46 +08:00
2026-07-15 23:58:46 +08:00
2026-07-08 13:50:49 +08:00
2026-07-15 03:54:32 +08:00
2026-07-17 15:07:41 +08:00
2026-07-16 00:16:21 +08:00
2026-07-15 03:54:32 +08:00
2026-07-17 15:07:41 +08:00
2026-07-20 15:20:51 +08:00
2026-07-20 15:20:51 +08:00
2026-07-15 19:57:37 -07:00
2026-07-15 19:57:37 -07:00
2026-07-15 19:57:37 -07:00
2026-07-19 00:56:21 -07:00
2026-07-18 00:11:18 +08:00
2026-07-18 00:11:18 +08:00
2026-07-13 09:54:51 +08:00
2026-07-13 16:29:18 +08:00
2026-07-13 16:29:18 +08:00
2026-07-10 10:00:47 +08:00
2026-07-15 09:35:34 -07:00
2026-07-19 11:39:20 +08:00
2026-07-19 11:23:26 +08:00
2026-07-15 09:40:08 +08:00
2026-07-15 09:40:08 +08:00
2026-07-14 01:09:07 +08:00
2026-07-23 15:50:44 +08:00
2026-07-25 21:59:20 +07:00
2026-07-25 18:34:37 +08:00
2026-07-15 22:52:35 +08:00
2026-07-15 22:52:35 +08:00
2026-07-25 05:31:31 +08:00
2026-07-25 15:37:05 +08:00
2026-07-15 22:52:35 +08:00
2026-07-20 16:12:56 +08:00
2026-07-23 00:12:28 +08:00
2026-07-20 21:44:42 +08:00
2026-07-16 00:40:46 +08:00
2026-07-23 00:12:28 +08:00
2026-07-14 19:04:04 +08:00
2026-07-14 19:24:56 +08:00
2026-07-14 19:24:56 +08:00
2026-07-13 11:10:33 +08:00
2026-07-17 08:44:23 +08:00
2026-07-17 18:12:33 +08:00
2026-07-21 05:02:30 -07:00
2026-07-21 05:02:30 -07:00
2026-07-06 19:03:36 +08:00
2026-07-06 19:03:36 +08:00
2026-07-10 23:32:34 +08:00
2026-07-21 05:02:30 -07:00
2026-07-21 05:02:30 -07:00
2026-07-10 23:32:34 +08:00
2026-07-20 15:30:31 +08:00
2026-07-20 15:30:31 +08:00
2026-07-20 18:49:24 +08:00
2026-07-24 20:15:58 +08:00
2026-07-10 09:56:33 +08:00
2026-07-08 10:04:14 +08:00
2026-07-11 12:51:53 +08:00
2026-07-11 08:52:46 +08:00
2026-07-13 08:54:31 +08:00
2026-07-10 10:25:09 +08:00
2026-07-10 10:18:16 +08:00
2026-07-19 22:28:49 +08:00
2026-07-14 16:53:21 +08:00
2026-07-14 16:53:21 +08:00
2026-07-14 16:53:21 +08:00
2026-07-17 18:12:33 +08:00
2026-07-15 23:58:46 +08:00
2026-07-15 23:58:46 +08:00
2026-07-10 15:16:09 +08:00
2026-07-10 15:16:09 +08:00
2026-07-15 13:01:16 +08:00
2026-07-15 13:01:16 +08:00
2026-07-25 01:40:26 +08:00
2026-07-22 13:32:35 +08:00
2026-07-10 15:13:11 +08:00
2026-07-22 13:32:35 +08:00
2026-07-19 19:48:25 +08:00
2026-07-19 19:48:25 +08:00
2026-07-19 12:17:23 +08:00
2026-07-19 12:17:23 +08:00
2026-07-25 13:42:35 +08:00
2026-07-21 15:22:12 +08:00
2026-07-17 16:59:40 +08:00
2026-07-24 01:22:34 +08:00
2026-07-21 15:22:12 +08:00
2026-07-22 13:32:35 +08:00
2026-07-20 16:12:56 +08:00
2026-07-26 21:04:18 +08:00
2026-07-22 12:15:48 +08:00
2026-07-22 12:15:48 +08:00
2026-07-25 14:32:18 +08:00
2026-07-11 20:47:52 +08:00
2026-07-15 00:44:13 +08:00
2026-07-15 14:07:01 +08:00
2026-07-09 15:49:10 +08:00
2026-07-10 15:13:11 +08:00
2026-07-20 11:39:37 +08:00
2026-07-17 22:10:18 +08:00
2026-07-15 00:00:40 +08:00
2026-07-14 21:57:26 +08:00
2026-07-14 21:57:26 +08:00
2026-07-23 00:12:28 +08:00
2026-07-27 00:43:53 +08:00
2026-07-26 13:33:56 +08:00
2026-07-26 13:33:56 +08:00
2026-07-09 20:06:09 +08:00
2026-07-19 18:50:33 +08:00
2026-07-20 16:29:12 +08:00
2026-07-19 18:50:33 +08:00
2026-07-23 00:12:28 +08:00
2026-07-13 14:42:16 +08:00
2026-07-24 01:22:34 +08:00
2026-07-06 19:03:36 +08:00
2026-07-16 00:23:40 -07:00
2026-07-23 00:12:28 +08:00
2026-07-25 12:50:46 +08:00
2026-07-22 13:32:35 +08:00
2026-07-27 00:43:53 +08:00
2026-07-11 12:51:53 +08:00
2026-07-14 20:31:17 +08:00
2026-07-16 17:11:00 +08:00
2026-07-15 04:20:11 +08:00
2026-07-15 06:59:00 +08:00
2026-07-14 20:31:17 +08:00
2026-07-14 11:24:44 +08:00
2026-07-15 03:15:47 +08:00
2026-07-17 18:12:33 +08:00
2026-07-17 08:44:23 +08:00
2026-07-17 18:12:33 +08:00
2026-07-25 12:50:46 +08:00
2026-07-25 15:15:59 +08:00
2026-07-25 12:51:20 +08:00
2026-07-25 12:50:46 +08:00
2026-07-25 15:15:59 +08:00
2026-07-13 17:57:08 +08:00
2026-07-10 15:13:11 +08:00
2026-07-10 15:13:11 +08:00
2026-07-13 17:57:08 +08:00
2026-07-13 17:57:08 +08:00
2026-07-07 15:00:00 +08:00
2026-07-24 02:59:32 +08:00
2026-07-22 16:46:29 +08:00
2026-07-23 00:12:28 +08:00
2026-07-23 00:12:28 +08:00
2026-07-15 02:51:56 +08:00
2026-07-15 02:51:56 +08:00
2026-07-15 18:30:16 +08:00
2026-07-15 18:30:16 +08:00
2026-07-10 11:09:06 +08:00
2026-07-21 11:16:04 +08:00
2026-07-21 11:16:04 +08:00
2026-07-16 00:19:20 +08:00
2026-07-25 01:40:26 +08:00
2026-07-15 22:23:57 +08:00
2026-07-15 22:23:57 +08:00
2026-07-24 02:59:32 +08:00
2026-07-24 02:59:32 +08:00
2026-07-24 02:59:32 +08:00
2026-07-15 22:37:30 +08:00
2026-07-15 21:20:41 +08:00
2026-07-15 02:41:23 +08:00
2026-07-18 03:24:04 +08:00
2026-07-25 15:37:06 +08:00
2026-07-25 15:37:05 +08:00
2026-07-15 22:15:44 +08:00
2026-07-18 19:17:53 +08:00
2026-07-13 15:32:42 +08:00
2026-07-14 19:04:04 +08:00
2026-07-16 17:11:00 +08:00
2026-07-10 06:37:06 +00:00
2026-07-26 13:43:06 +08:00
2026-07-10 10:11:21 +08:00
2026-07-21 05:02:30 -07:00
2026-07-24 02:59:32 +08:00
2026-07-15 22:52:35 +08:00
2026-07-15 22:52:35 +08:00
2026-07-16 17:11:00 +08:00
2026-07-26 13:43:06 +08:00
2026-07-26 13:43:06 +08:00
2026-07-26 13:43:06 +08:00
2026-07-13 15:32:42 +08:00
2026-07-14 19:04:04 +08:00
2026-07-15 22:52:35 +08:00
2026-07-10 11:56:47 +08:00
2026-07-26 13:43:06 +08:00
2026-07-18 19:17:53 +08:00
2026-07-15 23:58:46 +08:00
2026-07-18 00:11:18 +08:00
2026-07-18 00:11:18 +08:00
2026-07-18 00:11:18 +08:00
2026-07-18 00:42:16 +08:00
2026-07-18 00:11:18 +08:00
2026-07-14 16:18:26 +08:00
2026-07-14 16:18:26 +08:00
2026-07-18 00:11:18 +08:00
2026-07-18 00:11:18 +08:00
2026-07-18 00:11:18 +08:00
2026-07-18 00:11:18 +08:00
2026-07-18 00:11:18 +08:00
2026-07-19 11:23:26 +08:00
2026-07-19 11:39:20 +08:00
2026-07-14 14:55:30 +08:00
2026-07-18 00:11:18 +08:00
2026-07-18 00:11:18 +08:00
2026-07-18 00:11:18 +08:00
2026-07-18 00:11:18 +08:00
2026-07-18 00:11:18 +08:00
2026-07-14 01:29:46 +08:00
2026-07-14 01:29:46 +08:00
2026-07-18 00:11:18 +08:00
2026-07-18 00:11:18 +08:00
2026-07-18 03:24:04 +08:00
2026-07-14 14:55:30 +08:00
2026-07-14 14:55:30 +08:00
2026-07-06 15:00:29 +08:00
2026-07-06 15:00:29 +08:00
2026-07-15 11:17:45 +08:00
2026-07-15 11:17:45 +08:00
2026-07-06 15:00:29 +08:00
2026-07-06 15:00:29 +08:00
2026-07-22 19:18:04 +08:00
2026-07-22 19:18:04 +08:00
2026-07-22 19:18:04 +08:00
2026-07-10 10:56:49 +08:00
2026-07-14 01:29:30 +08:00
2026-07-22 19:18:04 +08:00
2026-07-22 19:18:04 +08:00
2026-07-14 01:29:30 +08:00
2026-07-06 15:00:29 +08:00
2026-07-26 03:18:30 +08:00
2026-07-26 03:18:30 +08:00
2026-07-26 03:18:30 +08:00
2026-07-22 19:18:04 +08:00
2026-07-26 01:56:10 +08:00
2026-07-26 01:56:10 +08:00
2026-07-15 23:58:46 +08:00
2026-07-07 23:19:23 +08:00
2026-07-18 15:35:30 +08:00
2026-07-18 20:41:12 +08:00
2026-07-17 22:10:18 +08:00
2026-07-10 10:56:49 +08:00
2026-07-14 14:55:30 +08:00
2026-07-16 13:47:50 +08:00
2026-07-25 19:40:53 +08:00
2026-07-25 19:40:53 +08:00
2026-07-15 00:12:40 +08:00
2026-07-13 21:56:47 +08:00
2026-07-17 22:10:18 +08:00
2026-07-16 00:11:17 +08:00
2026-07-17 22:10:18 +08:00
2026-07-15 04:23:06 +08:00
2026-07-15 05:31:50 +08:00
2026-07-15 00:12:40 +08:00
2026-07-15 13:24:08 +08:00
2026-07-15 04:23:06 +08:00
2026-07-21 03:07:01 +08:00
2026-07-16 13:47:50 +08:00
2026-07-24 01:22:34 +08:00
2026-07-24 01:22:34 +08:00
2026-07-18 10:46:42 +08:00
2026-07-10 09:56:33 +08:00
2026-07-08 08:49:20 +08:00
2026-07-27 15:12:51 +08:00
2026-07-27 15:12:51 +08:00
2026-07-20 00:09:11 +08:00
2026-07-08 08:49:20 +08:00
2026-07-20 00:09:11 +08:00
2026-07-27 15:12:51 +08:00
2026-07-25 21:03:00 +08:00
2026-07-20 00:09:00 +08:00
2026-07-18 14:42:22 +08:00
2026-07-19 21:37:26 +08:00
2026-07-10 10:56:49 +08:00
2026-07-10 10:56:49 +08:00
2026-07-18 14:42:22 +08:00
2026-07-25 21:59:20 +07:00
2026-07-15 09:40:08 +08:00
2026-07-15 09:40:08 +08:00
2026-07-15 09:40:08 +08:00
2026-07-10 02:27:33 -04:00
2026-07-09 11:05:05 -04:00
2026-07-16 16:49:08 +08:00
2026-07-16 16:49:08 +08:00
2026-07-09 22:30:04 +08:00
2026-07-09 22:30:04 +08:00
2026-07-17 20:59:29 +08:00
2026-07-17 20:59:29 +08:00
2026-07-22 13:32:35 +08:00
2026-07-22 13:32:35 +08:00
2026-07-27 00:43:53 +08:00
2026-07-25 15:16:05 +08:00
2026-07-06 20:27:13 +08:00
2026-07-06 20:27:13 +08:00
2026-07-25 19:40:53 +08:00
2026-07-25 19:40:53 +08:00
2026-07-18 14:42:22 +08:00
2026-07-19 21:37:26 +08:00
2026-07-10 10:56:49 +08:00
2026-07-19 21:37:26 +08:00
2026-07-14 01:29:30 +08:00
2026-07-14 01:29:30 +08:00
2026-07-09 15:38:59 +08:00
2026-07-23 15:50:44 +08:00