Chat Code Review

27/200

27 of 200

PR #847 Review

Sarah Kim

Approved

Sarah Kim10:32 AM

Hey, I finished the auth middleware refactor. Can you take a look at the PR?

You10:34 AM

Sure, pulling it up now.

#847 Refactor auth middleware with rate limitingChanges requested

src/middleware/auth.tsL24

24- const token = req.headers.authorization

24+ const token = req.headers.get("authorization")

25+ if (!token) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })

This should handle the Bearer prefix. Split on space and take the second element, otherwise the JWT validation will fail with the full header value.

src/middleware/rate-limit.tsL13

11 const windowMs = 15 * 60 * 1000

12+ const maxRequests = 100

13+ const key = `rate:${ip}:${Math.floor(Date.now() / windowMs)}`

Using Date.now() in the key means rate limit windows drift with each request. Consider using a fixed window start timestamp from Redis instead.

Sarah Kim10:52 AM

Good catches. I'll fix the Bearer prefix parsing and switch to Redis EXPIREAT for the window. Give me 20 minutes.

Pushed the fixes. Ready for another look.

You11:22 AM

#847 Refactor auth middleware with rate limitingApproved

src/middleware/auth.ts

24+ const raw = req.headers.get("authorization") ?? ""

25+ const token = raw.startsWith("Bearer ") ? raw.slice(7) : raw

Clean fix. This handles both cases correctly.