Refactor authentication and streaming cookie handling: implement secure cookie logic based on environment in AuthEndpoints and StreamingEndpoints, enhance rate limiting policy in Program.cs, and update logging configuration in appsettings.json. Fix validation behavior to use asynchronous validation methods and improve error handling in frontend components.

backend/src/TeleWave.Api/Program.cs

@@ -1,5 +1,6 @@
 using System.Net;
 using System.Text.Json.Serialization;
+using System.Threading.RateLimiting;
 using Microsoft.AspNetCore.HttpOverrides;
 using Microsoft.AspNetCore.RateLimiting;
 using Scalar.AspNetCore;
@@ -63,19 +64,23 @@ builder.Services.AddHttpContextAccessor();
 builder.Services.AddApplication();
 builder.Services.AddInfrastructure(builder.Configuration);
 
+var authPermitLimit = builder.Configuration.GetValue("RateLimiting:AuthPermitLimit", 20);
 builder.Services.AddRateLimiter(options =>
 {
-    options.AddFixedWindowLimiter(
+    // Партиционируем по IP клиента (реальный адрес доступен после UseForwardedHeaders): единый
+    // непартиционированный лимит превращается в DoS — один клиент исчерпывает окно логина для всех.
+    options.AddPolicy(
         RateLimiting.AuthPolicy,
-        limiterOptions =>
-        {
-            limiterOptions.PermitLimit = builder.Configuration.GetValue(
-                "RateLimiting:AuthPermitLimit",
-                20
-            );
-            limiterOptions.Window = TimeSpan.FromMinutes(1);
-            limiterOptions.QueueLimit = 0;
-        }
+        httpContext =>
+            RateLimitPartition.GetFixedWindowLimiter(
+                httpContext.Connection.RemoteIpAddress?.ToString() ?? "unknown",
+                _ => new FixedWindowRateLimiterOptions
+                {
+                    PermitLimit = authPermitLimit,
+                    Window = TimeSpan.FromMinutes(1),
+                    QueueLimit = 0,
+                }
+            )
     );
     options.RejectionStatusCode = StatusCodes.Status429TooManyRequests;
 });