Reject bot-probe paths on the event alias route before hitting the DB

The public [redirectUrl] catch-all route (and its backend counterpart, GET /api/events/by-alias/:redirectUrl) matched any unmatched top-level path, so routine bot/scanner traffic (/wp-login.php, /.env, etc.) was firing a live database query on every hit. That traffic pattern looks like the cause of the P1017 "server has closed the connection" storms and OOM crashes seen from v1.7 onward. Both now reject anything that isn't a plausible alias (letters/numbers/hyphens/underscores) before touching Prisma. Also adds a max_memory_restart safety net to PM2 for both processes. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-08-27 09:33:23 +02:00
parent a0ccce04a3
commit 0e8d5f93c9
4 changed files with 35 additions and 4 deletions
@@ -7,6 +7,14 @@ and this project follows [Semantic Versioning](https://semver.org/).

 ## [Unreleased]

+### Fixed
+
+- The public event-alias route (`/:redirectUrl`, used for short links like `/camp-2025`) is a catch-all matching any unmatched top-level path, so every bot/scanner probe for a nonexistent page (`/wp-login.php`, `/.env`, etc.) was hitting the backend and firing a live database query. Both the frontend route and the `GET /api/events/by-alias/:redirectUrl` endpoint now reject anything that isn't a plausible alias (letters/numbers/hyphens/underscores) before touching the database, instead of forwarding scanner noise straight through — this traffic pattern could exhaust the database connection pool and take the server down under load.
+
+### Added
+
+- PM2 (`ecosystem.config.js`) now restarts either process if it exceeds 500MB of memory, instead of letting an unbounded leak run until the OS OOM-kills it.
+
 ## [1.9.4] - 2026-08-26

 ### Added