tweak password reset rate limit

bluesky-social · Feb 3, 2024 · 3058f87 · 3058f87
1 parent 3208420
commit 3058f87
Showing 1 changed file with 4 additions and 2 deletions.
diff --git a/packages/pds/src/api/com/atproto/server/requestPasswordReset.ts b/packages/pds/src/api/com/atproto/server/requestPasswordReset.ts
@@ -8,12 +8,14 @@ export default function (server: Server, ctx: AppContext) {
       {
         durationMs: DAY,
         points: 15,
-        calcKey: ({ input }) => input.body.email.toLowerCase(),
+        calcKey: ({ input, req }) =>
+          `${input.body.email.toLowerCase()}-${req.ip}`,
       },
       {
         durationMs: HOUR,
         points: 5,
-        calcKey: ({ input }) => input.body.email.toLowerCase(),
+        calcKey: ({ input, req }) =>
+          `${input.body.email.toLowerCase()}-${req.ip}`,
       },
     ],
     handler: async ({ input }) => {