rob/CamperCan
rob/CamperCan
Watch
1
0
Fork
You've already forked CamperCan
 0
Code Issues Pull requests Projects Releases Packages 1 Wiki Activity Actions

Add honeypot field and per-IP rate limit to registration #11

Merged
Claude merged 2 commits from cc-4-spam into site-hardening 2026-10-07 14:11:18 +00:00
Conversation 0 Commits 2 Files changed 6 +45 -2
Claude commented 2026-10-07 14:07:31 +00:00
Collaborator
Copy link

Adds a hidden website honeypot to the register form and an in-memory limit of 5 submits per 60 seconds per client IP (first X-Forwarded-For entry, else the socket address). A filled honeypot gets the normal 303 to /thanks with nothing logged. Over the limit gets a 429, and site.js shows "Too many tries, give it a minute."

Needs NPM to pass X-Forwarded-For (noted in README). The limit is per process and resets on restart.

Tested: node --test (15 pass), html-validate clean. Axe not run here.

Ticket: CC-4

Adds a hidden `website` honeypot to the register form and an in-memory limit of 5 submits per 60 seconds per client IP (first `X-Forwarded-For` entry, else the socket address). A filled honeypot gets the normal 303 to `/thanks` with nothing logged. Over the limit gets a 429, and `site.js` shows "Too many tries, give it a minute." Needs NPM to pass `X-Forwarded-For` (noted in README). The limit is per process and resets on restart. Tested: `node --test` (15 pass), `html-validate` clean. Axe not run here. Ticket: CC-4
Add honeypot field and per-IP rate limit to registration
All checks were successful
CI / check (pull_request) Successful in 9s
Details
04ed9cf23a
Claude reviewed 2026-10-07 14:07:52 +00:00
Claude left a comment
Copy link

test/server.test.js: the other register tests post with no X-Forwarded-For, so they share one limiter key. They already use 4 of the 5 slots. The next register test added there will get a 429. Give the shared post helper a unique X-Forwarded-For per call, or leave a slot free.

test/server.test.js: the other register tests post with no X-Forwarded-For, so they share one limiter key. They already use 4 of the 5 slots. The next register test added there will get a 429. Give the shared `post` helper a unique X-Forwarded-For per call, or leave a slot free.
Give each test POST its own forwarded address
All checks were successful
CI / check (pull_request) Successful in 11s
Details
91b44ad49e
Claude merged commit 841b3d9e31 into site-hardening 2026-10-07 14:11:18 +00:00
Claude deleted branch cc-4-spam 2026-10-07 14:11:18 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
rob/CamperCan!11
No description provided.