* chore: Add system wide rate limiting
* Handle and convert HttpError to 429
* Make algo 32-bit to prevent <ES2020 error + fix sms manager unit test
* Change core to common to go from 10 requests per minute to 200
* Remove redundant function
* Fix integration tests
* Make sure we allow all legal POST routes
* Allow tRPC post calls
* Add matcher tests on middleware
* Add matcher tests on middleware
* Fix matcher to not use regex
* Fix missing POST allow rule for /api/auth/callback/credentials
* Missed the api/book/event endpoints
* Add missing pages/api routes
* Remove POST middleware for now, very risky
* Remove tests for POST protection
---------
Co-authored-by: Volnei Munhoz <volnei.munhoz@gmail.com>
* Middleware only logic to add CSP header as Next.js App Router doesnt allow setting header in server component
* add tests
* Remove nonce from Page Router and fix ts issues
* Add checkly test
* feat: remove unused x-cal-timezone header and middleware matcher
- Remove x-cal-timezone header setting from middleware.ts
- Remove x-cal-timezone header setting from createNextApiHandler.ts
- Remove /api/trpc/:path* from middleware matcher
- Eliminates ~50M edge requests per month for unused functionality
- All timezone handling uses browser detection and localStorage instead
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
* update POST_METHODS_ALLOWED_API_ROUTES
* test: remove api/trpc POST validation test
- Remove test for /api/trpc/book/event POST requests since /api/trpc/:path* was removed from middleware matcher
- Keep test for /api/auth/signup which is still processed by middleware
Co-Authored-By: keith@cal.com <keithwillcode@gmail.com>
---------
Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Co-authored-by: hbjORbj <sldisek783@gmail.com>
* chore: block POST requests to next.js routes except a whitelist
* update config.matcher
---------
Co-authored-by: Keith Williams <keithwillcode@gmail.com>
