Skip to content

Support ip based rate limiting for Next.js#1049

Open
timokoessler wants to merge 3 commits into
mainfrom
nextjs-ip-ratelimiting
Open

Support ip based rate limiting for Next.js#1049
timokoessler wants to merge 3 commits into
mainfrom
nextjs-ip-ratelimiting

Conversation

@timokoessler
Copy link
Copy Markdown
Member

@timokoessler timokoessler commented Jun 1, 2026

Summary by Aikido

Security Issues: 0 🔍 Quality Issues: 1 Resolved Issues: 0

⚡ Enhancements

  • Added IP-based rate limiting and blocking response for Next.js requests
  • Escaped IP in responses and used shouldBlockRequest middleware

🔧 Refactors

  • Propagated body-read flag through listener and renamed related variables

More info

Comment thread library/ratelimiting/shouldRateLimitRequest.ts Outdated
@timokoessler timokoessler force-pushed the nextjs-ip-ratelimiting branch from 2e50c96 to c02dacb Compare June 1, 2026 15:49
Comment thread library/sources/http-server/createRequestListener.ts
@codecov
Copy link
Copy Markdown

codecov Bot commented Jun 1, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

@timokoessler timokoessler force-pushed the nextjs-ip-ratelimiting branch from cf7e3e4 to 95b6e51 Compare June 1, 2026 16:44
});

t.test("rate limits requests when NEXT_DEPLOYMENT_ID is set", async (t) => {
process.env.NEXT_DEPLOYMENT_ID = "";
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this is fine, but is it not better giving it an actual value here? I think sometimes an empty value could be confused for it not being set?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants