7828f9c419
An unauthenticated attacker could guess a real device_id and 429-lock that camera by hammering /api/events before HMAC verification ran, dropping its accident events. Add a cheap pre-auth per-IP limiter (Config::ingestIpRateLimitPerMin, default 300/min) that fires before any device-secret lookup, and move the existing per-device limiter to run only after HMAC + timestamp + nonce checks succeed, so only authenticated requests consume a device's own quota. |
||
|---|---|---|
| .. | ||
| docs | ||
| public | ||
| src | ||
| tests | ||
| .gitignore | ||
| composer.json | ||
| composer.lock | ||
| config.example.php | ||
| phpunit.xml | ||
| schema.sql | ||