v1.2.35 - Fix: only record idle ban failures for WebSocket connections, not HTTP requests (NIP-11/embedded files)

relay.pid

@@ -1 +1 @@
-2266130
+2297342

src/default_config_event.h

@@ -85,7 +85,7 @@ static const struct {
 
     // Debug Level (0=none, 1=errors, 2=warnings, 3=info, 4=debug, 5=trace)
     // Can be changed at runtime without restart via config_set admin command
-    {"debug_level", "0"},
+    {"debug_level", "3"},
 
     // IP Auth Failure Ban Settings
     // Ban IPs that repeatedly fail NIP-42 authentication
@@ -103,8 +103,8 @@ static const struct {
     // Ban IPs that connect but never send REQ or EVENT (idle or early disconnect)
     {"idle_connection_timeout_sec", "30"},  // Seconds before idle connection is closed (0 = disabled)
     {"idle_ban_enabled", "true"},           // Whether to ban IPs with idle failures
-    {"idle_ban_threshold", "3"},            // Idle failures before ban
-    {"idle_ban_window_sec", "60"},          // Window to count idle failures in
+    {"idle_ban_threshold", "1"},            // Idle failures before ban (1 = ban on first offense)
+    {"idle_ban_window_sec", "30"},          // Window to count idle failures in
     {"idle_ban_duration_sec", "300"},       // Initial ban duration (doubles each time, max 24h)
 
     // SQLite Performance Tuning

src/ip_ban.c

@@ -360,8 +360,8 @@ void ip_ban_record_idle_failure(const char* ip) {
     if (!ip || !g_initialized) return;
     if (!get_config_bool("idle_ban_enabled", 1)) return;
 
-    int threshold = get_config_int("idle_ban_threshold", 3);
-    int window_sec = get_config_int("idle_ban_window_sec", 60);
+    int threshold = get_config_int("idle_ban_threshold", 1);
+    int window_sec = get_config_int("idle_ban_window_sec", 30);
     int ban_duration = get_config_int("idle_ban_duration_sec", 300);
 
     pthread_mutex_lock(&g_ban_mutex);

src/main.h

@@ -13,8 +13,8 @@
 // Using CRELAY_ prefix to avoid conflicts with nostr_core_lib VERSION macros
 #define CRELAY_VERSION_MAJOR 1
 #define CRELAY_VERSION_MINOR 2
-#define CRELAY_VERSION_PATCH 31
-#define CRELAY_VERSION "v1.2.31"
+#define CRELAY_VERSION_PATCH 35
+#define CRELAY_VERSION "v1.2.35"
 
 // Relay metadata (authoritative source for NIP-11 information)
 #define RELAY_NAME "C-Relay"

src/websockets.c

@@ -405,6 +405,12 @@ static int nostr_relay_callback(struct lws *wsi, enum lws_callback_reasons reaso
     switch (reason) {
         case LWS_CALLBACK_HTTP:
             // Handle HTTP requests
+            // Mark session as active so HTTP requests don't trigger idle ban
+            if (pss) {
+                pthread_mutex_lock(&pss->session_lock);
+                pss->session_active = 1;
+                pthread_mutex_unlock(&pss->session_lock);
+            }
             {
                 char *requested_uri = (char *)in;
 
@@ -458,6 +464,12 @@ static int nostr_relay_callback(struct lws *wsi, enum lws_callback_reasons reaso
                         int is_nip11_request = (strstr(accept_header, "application/nostr+json") != NULL);
 
                         if (is_nip11_request) {
+                            // Mark session as active so HTTP requests don't trigger idle ban
+                            if (pss) {
+                                pthread_mutex_lock(&pss->session_lock);
+                                pss->session_active = 1;
+                                pthread_mutex_unlock(&pss->session_lock);
+                            }
                             // Handle NIP-11 request
                             if (handle_nip11_http_request(wsi, accept_header) == 0) {
                                 return 0; // Successfully handled
@@ -622,6 +634,9 @@ static int nostr_relay_callback(struct lws *wsi, enum lws_callback_reasons reaso
             pss->challenge_created = 0;
             pss->challenge_expires = 0;
 
+            // Mark as WebSocket connection (not HTTP)
+            pss->is_websocket = 1;
+
             // Register in global connection list for idle tracking
             connection_list_add(wsi, pss);
 
@@ -2248,7 +2263,8 @@ static int nostr_relay_callback(struct lws *wsi, enum lws_callback_reasons reaso
                 // This catches:
                 // 1. Idle connections that timed out (never sent REQ/EVENT/AUTH)
                 // 2. Early disconnects (client closed before sending REQ/EVENT/AUTH)
-                if (!pss->session_active && strlen(pss->client_ip) > 0) {
+                // Only record for WebSocket connections, not HTTP requests (NIP-11, embedded files)
+                if (!pss->session_active && pss->is_websocket && strlen(pss->client_ip) > 0) {
                     // Use separate idle failure recording (has its own threshold/duration)
                     ip_ban_record_idle_failure(pss->client_ip);
                     DEBUG_LOG("Recording idle/early-disconnect failure for IP %s (connected %ld seconds)",

src/websockets.h

@@ -93,6 +93,7 @@ struct per_session_data {
     // Session activity tracking for idle connection banning
     int session_active;                       // 1 if client sent REQ or EVENT, 0 otherwise
     int idle_timeout_sec;                     // Timeout value for this session (copied from config)
+    int is_websocket;                         // 1 if this is a WebSocket connection, 0 for HTTP
 };
 
 // NIP-11 HTTP session data structure for managing buffer lifetime