Failing tests, ahead of the change: with maintenance_mode on, both image
routes must answer 503 with a Retry-After header and the JSON error body,
while the health check keeps answering 200 and reporting
maintenance_mode, and the login page and /metrics keep answering 200.
The test server now also builds the health check, which these tests
request.
Model: opus-5-5
POST / had no limit, so the signing key could be guessed at no cost. It
is now limited to 5 attempts per minute per client by a new RateLimit
middleware on github.com/go-chi/httprate; an attempt over the limit gets
429 with Retry-After. It counts by the address the ClientIP middleware
resolved through trusted_proxies (an IPv4-mapped address as its IPv4
address, IPv6 by its /64) and runs after the body-size and CSRF checks,
so every attempt that reaches the key comparison is counted. README says
that with the default trusted_proxies a client with a private address
can choose its counted address, and how to close that.
Model: opus-5-5
clawbot