fix(public-api): configure trust proxy for rate limiter#293
fix(public-api): configure trust proxy for rate limiter#293Gagan-astatine wants to merge 1 commit into
Conversation
Gagan-astatine
requested review from
Nitin-kumar-yadav1307 and
yash-pouranik
as code owners
📝 WalkthroughWalkthroughThe PR removes the rate limiter's problematic ChangesRate Limiter Proxy Trust Fix
Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@apps/public-api/src/app.js`:
- Around line 118-121: The Not Found handler currently sends a 200 response;
update the middleware passed to app.use (the anonymous function that reads
X-Kiroo-Replay-ID) to set the HTTP status to 404 before sending JSON (e.g., call
res.status(404) or res.statusCode = 404) so unknown routes return a proper 404
Not Found response while still including the replayId in the response body.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: ad6d9a2b-883a-4630-8d67-0ca1e7fde825
⛔ Files ignored due to path filters (1)
package-lock.jsonis excluded by!**/package-lock.json
📒 Files selected for processing (2)
apps/public-api/src/app.jsapps/public-api/src/middlewares/api_usage.js
| app.use((req, res) => { | ||
| const id = res.get("X-Kiroo-Replay-ID"); | ||
| res.json({error: "Not Found", replayId: id}) | ||
| res.json({ error: "Not Found", replayId: id }) | ||
| }) |
There was a problem hiding this comment.
Return 404 in the Not Found handler.
This handler currently responds with 200 OK, which breaks HTTP semantics and client error handling for unknown routes.
Suggested fix
app.use((req, res) => {
const id = res.get("X-Kiroo-Replay-ID");
- res.json({ error: "Not Found", replayId: id })
+ res.status(404).json({ error: "Not Found", replayId: id })
})📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| app.use((req, res) => { | |
| const id = res.get("X-Kiroo-Replay-ID"); | |
| res.json({error: "Not Found", replayId: id}) | |
| res.json({ error: "Not Found", replayId: id }) | |
| }) | |
| app.use((req, res) => { | |
| const id = res.get("X-Kiroo-Replay-ID"); | |
| res.status(404).json({ error: "Not Found", replayId: id }) | |
| }) |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@apps/public-api/src/app.js` around lines 118 - 121, The Not Found handler
currently sends a 200 response; update the middleware passed to app.use (the
anonymous function that reads X-Kiroo-Replay-ID) to set the HTTP status to 404
before sending JSON (e.g., call res.status(404) or res.statusCode = 404) so
unknown routes return a proper 404 Not Found response while still including the
replayId in the response body.
|
@Gagan-astatine |
2 participants
🚀 Pull Request Description
Fixes #248
This PR resolves an issue with the rate limiter in the
public-apifailing or blocking incorrectly when deployed behind a proxy/load balancer.app.set('trust proxy', 1);.validateblock fromexpress-rate-limitconfiguration that was explicitly rejecting proxy-related headers.🛠️ Type of Change
🧪 Testing & Validation
Backend Verification:
npm testin thebackend/directory and all tests passed.Frontend Verification:
npm run lintin thefrontend/directory.📸 Screenshots / Recordings (Optional)
✅ Checklist
Built with ❤️ for urBackend.
Summary by CodeRabbit
Style
Chores