From 3692672f953013751a4de4bdebe02ad056ce7fdf Mon Sep 17 00:00:00 2001 From: Hanka Date: Sat, 27 Jun 2026 20:16:49 +0200 Subject: [PATCH] feat(security): add rate limiting to move endpoint --- app.py | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/app.py b/app.py index 3e5543f..df575cd 100644 --- a/app.py +++ b/app.py @@ -1,9 +1,17 @@ import random from flask import Flask, jsonify, render_template, request +from flask_limiter import Limiter +from flask_limiter.util import get_remote_address app = Flask(__name__) +limiter = Limiter( + app=app, + key_func=get_remote_address, + default_limits=["200 per day", "50 per hour"], +) + class TicTacToe: """ @@ -97,6 +105,7 @@ def index(): @app.route("/move", methods=["POST"]) +@limiter.limit("100/hour") def move(): """ Handles player moves via POST requests.