fix(rate-limit): give each authenticated gateway subject its own API budget - #163
Merged
Merged
Conversation
…budget Behind the gateway, a course often shares one public IP. The global API limit of 300 requests per 15 minutes was keyed by IP and could throttle a whole class. Authenticated gateway subjects now get their own budget; everything else stays keyed by IP. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose
R7 of the refactoring series (
docs/UNOSIM_REFACTORING_OPL.md), audit finding P1.Finding re-verified
The global
/api/limiter (300 requests per 15 minutes in production) used the default keyreq.ip. Behind the gateway, a course on campus NAT shares one public IP, so one class could exhaust one budget. The identity-based compile, simulation and tutor limiters already key by subject.Change
apiRateLimitKey(req, trust)inserver/rate-limit-policy.ts, used as the limiter'skeyGenerator:getRequestAuthorizationthe routes use; requires the gateway secret): keysubject:<subject>.ip:<ipKeyGenerator(req.ip)>. This is the library's IPv6-aware default.No new authentication path, no change to limits, exemptions or the trust contract.
Tests
tests/server/routes/api-rate-limit-key.test.ts, in the serialized HTTP group. Two subjects behind one IP get separate budgets; invalid gateway secrets share the IP budget; local mode stays per IP.npm run check,check:docs, ESLint, unit 2710 passed, pre-push incl. Sonar quality gate PASSED.🤖 Generated with Claude Code