mirror of
https://github.com/go-vikunja/vikunja.git
synced 2026-08-23 17:46:28 -05:00
kolaenteandkolaente
2c9e71a2b3
With ratelimit.kind at its default value of "user", the rate limit middleware logged the error from GetAuthFromClaims and then dereferenced the nil web.Auth anyway. Every unauthenticated /api/v2 request produces exactly that state, since v2 attaches the limiter to the single group serving its public routes too - so enabling rate limiting turned /api/v2/info, /api/v2/health and /api/v2/login into 500s. v1 is unaffected because it splits its unauthenticated routes into their own ip-keyed subgroups before the "user" limiter is attached. Fall back to keying by IP, matching the "ip" kind and v1's unauthenticated groups. Authenticated requests are unchanged.