Browse: fix 429s (same-origin bypasses rate limit + bumped caps) - #170
Merged
Conversation
/browse loads ~60 animated cards on first paint. Each fires off
/api/pixabot/{id}?animated=true. The per-IP rate limit on animated
renders was 30/min, so 30 succeeded and the other 30+ came back 429
— broken thumbnails in the grid.
The limit exists to stop external consumers from hammering the
Sharp animated pipeline. Our own UI isn't abuse. Two fixes:
- New `isSameOrigin(request)` in `rate-limit.ts` — checks
`Sec-Fetch-Site: same-origin`, which modern browsers send on same-
origin image loads and which can't be forged cross-site by script.
External consumers (curl, other sites hotlinking, SDKs) still get
rate-limited.
- `/api/pixabot/[id]` and `/api/og` both skip `checkRate` when
`isSameOrigin` is true.
- Bumped the per-IP animated limit 30 → 120 and OG limit 20 → 60
so legitimate external consumers rendering a small grid don't hit
it on normal use either.
Hotlinkers, bots, and curl scripts still capped — just at a more
reasonable level for a themed avatar grid (e.g. 50-bot board).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
pablostanley
added a commit
that referenced
this pull request
Apr 20, 2026
… cache policy
Rolls the important stuff from this long session into the living docs
so next-agent (or next-me) doesn't have to reread the whole thread.
CLAUDE.md
- **Key conventions**: replace the old 8-frame-bounce line with the
16-tick super-loop model; add sub-animation `kind` (static/blink/
sequence) + `resolveFrameIndex` as the one source for frame picks;
document `TOTAL_COMBOS_LABEL` as the single-source for the count;
add the keydown `hasModifier` rule (earned from the ⌘R bug).
- **Adding new parts**: split static vs animated workflows. Static
is flat PNG + stitcher copy-through. Animated uses subdir layouts
(blink: open/closed pair, sequence: numbered) that the stitcher
detects automatically; updated the parts.ts entry shape
(`'name'` vs `{ name, frames, kind }`).
- **npm**: drop the stale "CLI token caveat" note — first-publish
is done, token allow-list extended.
- **API**: refresh the endpoint list (frames metadata, batch, palette
+ bg params); document the 1d fresh / 7d SWR cache policy and the
same-origin rate-limit bypass.
ROADMAP.md
- Appends Done entries for PR #158 (⌘R guard), #160 (SW bump),
#162 (TOTAL_COMBOS dedupe), #166/#168/#169 (cache revalidate),
and #170 (browse 429s). Each entry includes the "why we needed it"
so future readers see the failure mode, not just the fix.
Memory (not in this commit; lives outside the repo):
- New `feedback_keyboard_modifier_guard.md` — the ⌘R lesson promoted
to a rule.
- New `project_animation_infra.md` — the sub-animation mental model.
- Updated `project_npm_published.md` with current versions of core /
react / cli.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
pablostanley
added a commit
that referenced
this pull request
Apr 20, 2026
… cache policy (#171) Rolls the important stuff from this long session into the living docs so next-agent (or next-me) doesn't have to reread the whole thread. CLAUDE.md - **Key conventions**: replace the old 8-frame-bounce line with the 16-tick super-loop model; add sub-animation `kind` (static/blink/ sequence) + `resolveFrameIndex` as the one source for frame picks; document `TOTAL_COMBOS_LABEL` as the single-source for the count; add the keydown `hasModifier` rule (earned from the ⌘R bug). - **Adding new parts**: split static vs animated workflows. Static is flat PNG + stitcher copy-through. Animated uses subdir layouts (blink: open/closed pair, sequence: numbered) that the stitcher detects automatically; updated the parts.ts entry shape (`'name'` vs `{ name, frames, kind }`). - **npm**: drop the stale "CLI token caveat" note — first-publish is done, token allow-list extended. - **API**: refresh the endpoint list (frames metadata, batch, palette + bg params); document the 1d fresh / 7d SWR cache policy and the same-origin rate-limit bypass. ROADMAP.md - Appends Done entries for PR #158 (⌘R guard), #160 (SW bump), #162 (TOTAL_COMBOS dedupe), #166/#168/#169 (cache revalidate), and #170 (browse 429s). Each entry includes the "why we needed it" so future readers see the failure mode, not just the fix. Memory (not in this commit; lives outside the repo): - New `feedback_keyboard_modifier_guard.md` — the ⌘R lesson promoted to a rule. - New `project_animation_infra.md` — the sub-animation mental model. - Updated `project_npm_published.md` with current versions of core / react / cli. Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bug
`/browse` loads ~60 animated cards on first paint. Animated rate limit is 30/min per IP per lambda → 30 succeed, the other 30+ come back 429 → broken thumbnails in the grid. User hit it today.
Fix
The rate limit exists to stop external consumers from hammering the Sharp animated pipeline. Our own UI isn't abuse. Two changes:
Hotlinkers / curl scripts still capped — just at a more reasonable level.
Test plan
🤖 Generated with Claude Code