ToyBattles Update: Cooldowns Security Performance
Summary
ToyBattles - Free To Play announces a September 8 website update covering extended nickname cooldowns from one week to one month, clearer error messages, and prevention of duplicate requests. The update fixes a trust proxy vulnerability, restricts trusted proxies to Cloudflare and local ranges, adds MongoDB reservation tracking and a request queue, speeds availability checks with 500ms debouncing, and restores clan deletion and UI stability.
Improved Cooldown System
- Extended Cooldown: Changed from 1 week to 1 month between nickname changes
- Better Error Messages: Clear, user-friendly messages showing exact dates when next change is available
- Duplicate Request Prevention: System now prevents multiple pending requests from the same user
Security Enhancements
- Fixed Trust Proxy Vulnerability: Resolved critical security issue that could allow IP spoofing
- Secure Proxy Configuration: Now only trusts Cloudflare and local/private network ranges
- Rate Limiting Protection: Enhanced protection against abuse while maintaining legitimate access
Database
- Reservation Tracking: MongoDB integration for nickname reservations with expiration dates
- Request Queue: Improved handling of nickname change requests
- Index Optimization: Better database performance for nickname lookups
Bug Fixes
- Fixed duplicate nickname change request submissions
- Resolved rate limiting bypass vulnerability
- Improved error handling for network timeouts
- Fixed UI state management issues
Performance
- Faster Availability Checks: Debounced API calls (500ms) reduce server load
- Optimized Database Queries: Better indexing and query performance
- Reduced Bundle Size: Efficient code splitting and lazy loading
More tba
The clan deletion feature now works correctly! When you delete your clan, you'll immediately see the "Create Clan" option in the navigation menu instead of the old "My Clan" button.
Fixed the "My Clan" button & Leave clan button.
Also fixed an issue in the backend caused the server to crash.
