From 33f608e690d78d46fa779c43ca31aa9d6c6d75c4 Mon Sep 17 00:00:00 2001
From: Sergey Krylov <ksv741@mail.ru>
Date: Thu, 5 Nov 2026 07:14:39 +0300
Subject: [PATCH] fix: bound auth admission at nginx
 (WealthLedger/frontend#155)

---
 docker/nginx.conf | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/docker/nginx.conf b/docker/nginx.conf
index ef37b03..946f737 100644
--- a/docker/nginx.conf
+++ b/docker/nginx.conf
@@ -17,12 +17,21 @@ http {
         default $http_x_forwarded_proto;
         '' $scheme;
     }
+    # One shared budget: the external proxy's client-IP forwarding is not verified.
+    map "$request_method:$uri" $auth_admission_key {
+        default "";
+        POST:/api/v1/auth/login auth;
+        POST:/api/v1/auth/register auth;
+    }
+    limit_req_zone $auth_admission_key zone=auth_admission:1m rate=2r/s;
+    limit_req_status 429;
     server {
         listen 8080;
         server_name _;
         root /usr/share/nginx/html;
         resolver 127.0.0.11 valid=5s ipv6=off;
         location /api/ {
+            limit_req zone=auth_admission burst=5 nodelay;
             set $backend http://backend:3000;
             proxy_pass $backend$request_uri;
             proxy_set_header Host $http_host;