patx/gitman
Cover normalized auth path aliases in nginx rate limits
Commit 7e8f9c8 · patx · 2026-11-03T01:53:27-05:00
Comments
No comments yet.
Diff
diff --git a/deploy/nginx/README.md b/deploy/nginx/README.md
index 460fe6f..ce90656 100644
--- a/deploy/nginx/README.md
+++ b/deploy/nginx/README.md
@@ -45,7 +45,9 @@ fd 3 in the installed Gunicorn's socket list and fails startup.
- nginx buffers uploads before forwarding them, with finite body and concurrency
limits. These timeouts measure inactivity, not total request duration.
- Requests: 20/second/IP plus burst 80. Auth POSTs: 10/minute/IP plus burst 10.
- Auth GETs do not consume the auth-specific bucket. Excess returns HTTP 429.
+ Auth GETs do not consume the auth-specific bucket. Trailing-slash aliases share
+ the auth bucket; normalized URI matching also covers encoded path characters.
+ Excess returns HTTP 429.
- Active requests: 32/IP, 128/virtual host. Git additionally allows 4/IP and
8/virtual host; settings/imports allow 2/IP and 4/virtual host.
- Forwarded headers are overwritten consistently for all upstream locations.
diff --git a/deploy/nginx/gitman-http.conf b/deploy/nginx/gitman-http.conf
index cec3295..347b568 100644
--- a/deploy/nginx/gitman-http.conf
+++ b/deploy/nginx/gitman-http.conf
@@ -7,7 +7,7 @@ map $host $gitman_hsts {
}
map "$request_method:$uri" $gitman_auth_key {
default "";
- ~^POST:/(login|signup|settings/password)$ $binary_remote_addr;
+ ~^POST:/(login|signup|settings/password)/*$ $binary_remote_addr;
}
limit_req_zone $binary_remote_addr zone=gitman_requests:10m rate=20r/s;
limit_req_zone $gitman_auth_key zone=gitman_auth:10m rate=10r/m;