From b03ed825cd9acf96a6f5ad7dada3605e7441c760 Mon Sep 17 00:00:00 2001
From: Mohd Subhan <subhanmohammed631@gmail.com>
Date: Wed, 3 Jun 2026 12:07:26 +0530
Subject: [PATCH] fix(api): prevent rate limit bypass when client IP is unknown
 in notify route

---
 app/api/notify/route.ts | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/app/api/notify/route.ts b/app/api/notify/route.ts
index 0ee80c686..af1c6325b 100644
--- a/app/api/notify/route.ts
+++ b/app/api/notify/route.ts
@@ -37,7 +37,11 @@ export async function POST(req: NextRequest): Promise<NextResponse<NotificationR
   // Rate limiting
   const ip = getClientIp(req);
 
-  if (ip !== 'unknown' && !(await notifyRateLimiter.check(ip))) {
+  // fallback ensures rate limit is ALWAYS applied
+  const rateLimitKey =
+    ip && ip !== 'unknown' ? ip : `unknown:${req.headers.get('user-agent') ?? 'no-agent'}`;
+
+  if (!(await notifyRateLimiter.check(rateLimitKey))) {
     return NextResponse.json(
       { success: false, message: 'Too many requests, please try again later.' },
       { status: 429 }