mirror of
https://gitcode.com/JianFeeeee/ModelRouter.git
synced 2026-09-20 00:48:00 +00:00
77b00bfe3f
Prerequisite for removing the nginx global-auth layer in front of the gateway: llmsproxy must defend its own login endpoint. Design: - per-IP failure counter: 5 consecutive failures trigger an exponential lockout (30s base, doubling per extra burst, capped at 30min); 15min of quiet forgives the counter - global budget: max 100 failures/minute across all IPs so a distributed spray cannot outrun per-IP windows - locked-out and over-budget attempts get the SAME 'invalid gateway api key' 401 as normal failures — no oracle to probe lockout state, no info leak on key validity timing - successful login clears the IP's counter entirely - clientIP(): prefers X-Real-IP (trusted nginx proxy), falls back to RemoteAddr host Tests: lockout engages at threshold with identical replies, valid keys rejected while locked, other IPs unaffected, success resets counters, X-Real-IP extraction.