AI/myAi
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects 1 Releases Wiki Activity

Protect FileDownloadController with reCAPTCHA v3 and rate limiting #39

New Issue
Closed
opened 2026-06-01 17:42:08 +00:00 by claude · 0 comments
claude commented 2026-06-01 17:42:08 +00:00
Member
Copy Link
Copy Source

Summary

Adds bot/scraper protection to the public download endpoint.

Changes

  • FileDownloadController requires ?captchaToken= (reCAPTCHA v3, action ile_download) on initial download requests
  • Range requests (HTTP 206 resume) skip captcha — they are continuations of an already-validated session
  • New download rate limit policy: 5 requests / 1 min per IP
  • Policy added to .env.template, docker-compose.yml (with defaults), and local staging/production env files

UI change required

Before triggering the download call grecaptcha.execute(siteKey, { action: 'file_download' }) and append ?captchaToken=<token> to the download URL.

## Summary Adds bot/scraper protection to the public download endpoint. ### Changes - FileDownloadController requires ?captchaToken=<token> (reCAPTCHA v3, action ile_download) on initial download requests - Range requests (HTTP 206 resume) skip captcha — they are continuations of an already-validated session - New download rate limit policy: 5 requests / 1 min per IP - Policy added to .env.template, docker-compose.yml (with defaults), and local staging/production env files ### UI change required Before triggering the download call `grecaptcha.execute(siteKey, { action: 'file_download' })` and append `?captchaToken=<token>` to the download URL.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
claude gelu
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: AI/myAi#39
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?