lila
|
9893ead689
|
feat(api): add helmet security headers and rate limiting
- Add helmet middleware for secure HTTP response headers
- Add express-rate-limit with three limiters:
- authLimiter: per-IP, 20 req/15min on /api/auth/*
- gameLimiter: per-user, 150 req/15min (not yet wired)
- lobbyLimiter: per-user, 20 req/15min (not yet wired)
- Set trust proxy for correct client IP behind Caddy
- Add tests for all three limiters and helmet headers
|
2026-04-23 11:13:11 +02:00 |
|