- AdminDashboard: M() now sends admin_token from localStorage with fetch - rate-limit: keyGenerator uses req.ip instead of req.socket.remoteAddress (Express trust proxy reads X-Forwarded-For for real client IP) - main.ts: moved global rateLimiter after express.static so static files (JS/CSS/admin page/favicon) are never rate-limited
573 KiB
573 KiB