Potential fix for Missing rate limiting #582

New Issue

MrUnknownDE · 2026-04-05T17:22:46+02:00

MrUnknownDE commented

2026-04-05 17:22:46 +02:00

Originally created by @marcschaeferger on 11/29/2025

Community Contribution License Agreement

By creating this pull request, I grant the project maintainers an unlimited,
perpetual license to use, modify, and redistribute these contributions under any terms they
choose, including both the AGPLv3 and the Fossorial Commercial license terms. I
represent that I have the right to grant this license for all contributed content.

Description (generated by Copilot)

See https://codeql.github.com/codeql-query-help/javascript/js-missing-rate-limiting/

Code generated by Copilot

This pull request introduces rate limiting across several API endpoints to enhance security and prevent abuse. The changes add rate limiters to sensitive routes in both internal and external routers, as well as resource access token verification and integration endpoints. Each rate limiter is configured with specific limits and custom error messages to provide clear feedback to clients when limits are exceeded.

Rate Limiting for Sensitive and High-Traffic Endpoints:

Added a rate limiter to the /login-page route in server/private/routers/internal.ts, restricting access to 5 requests per minute per IP to prevent brute force and abuse.
Applied a rate limiter to the /resource/:resourceId/get-exchange-token endpoint in server/routers/internal.ts, allowing a maximum of 100 requests per 15 minutes per IP.

Resource Access Token Verification Protection:

Introduced a rate limiter to the /resource/:resourceId/access-token/verify endpoint in server/private/routers/hybrid.ts, capping requests at 10 per minute per IP to mitigate token brute-forcing. [1] [2]

External API Rate Limiting:

Implemented a rate limiter on the createRemoteExitNode endpoint in server/private/routers/external.ts, limiting each IP to 10 requests per minute and returning a custom error message on excess requests.

Integration API Rate Limiting:

Added a general rate limiter to all authenticated integration routes in server/routers/integration.ts, restricting each IP to 100 requests per 15 minutes and ensuring standard rate limit headers are sent.

These changes collectively strengthen the API against abuse and ensure fair usage across all clients.

*Originally created by @marcschaeferger on 11/29/2025* ## Community Contribution License Agreement By creating this pull request, I grant the project maintainers an unlimited, perpetual license to use, modify, and redistribute these contributions under any terms they choose, including both the AGPLv3 and the Fossorial Commercial license terms. I represent that I have the right to grant this license for all contributed content. ## Description (generated by Copilot) See https://codeql.github.com/codeql-query-help/javascript/js-missing-rate-limiting/ **Code generated by Copilot** This pull request introduces rate limiting across several API endpoints to enhance security and prevent abuse. The changes add rate limiters to sensitive routes in both internal and external routers, as well as resource access token verification and integration endpoints. Each rate limiter is configured with specific limits and custom error messages to provide clear feedback to clients when limits are exceeded. **Rate Limiting for Sensitive and High-Traffic Endpoints:** * Added a rate limiter to the `/login-page` route in `server/private/routers/internal.ts`, restricting access to 5 requests per minute per IP to prevent brute force and abuse. * Applied a rate limiter to the `/resource/:resourceId/get-exchange-token` endpoint in `server/routers/internal.ts`, allowing a maximum of 100 requests per 15 minutes per IP. **Resource Access Token Verification Protection:** * Introduced a rate limiter to the `/resource/:resourceId/access-token/verify` endpoint in `server/private/routers/hybrid.ts`, capping requests at 10 per minute per IP to mitigate token brute-forcing. [[1]](diffhunk://#diff-15c3a1839d668c5d989037e05f0c1a42d94ee116d676fad352658601b1e37efaR81-R92) [[2]](diffhunk://#diff-15c3a1839d668c5d989037e05f0c1a42d94ee116d676fad352658601b1e37efaR1191) **External API Rate Limiting:** * Implemented a rate limiter on the `createRemoteExitNode` endpoint in `server/private/routers/external.ts`, limiting each IP to 10 requests per minute and returning a custom error message on excess requests. **Integration API Rate Limiting:** * Added a general rate limiter to all authenticated integration routes in `server/routers/integration.ts`, restricting each IP to 100 requests per 15 minutes and ensuring standard rate limit headers are sent. These changes collectively strengthen the API against abuse and ensure fair usage across all clients.

MrUnknownDE closed this issue

2026-04-05 17:22:46 +02:00

Sign in to join this conversation.

Branches Tags

main

dev

dependabot/npm_and_yarn/dev-minor-updates-b4e5d6b9c5

revert-2766-feature/systemd-install-instructions

dependabot/npm_and_yarn/prod-patch-updates-05702d39f2

dependabot/npm_and_yarn/next-16.2.1

dependabot/npm_and_yarn/recharts-3.8.1

alerting-rules

private-site-ha

dependabot/docker/docker/library/node-25-slim

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

No Label

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pangolin#582