Where: internal/middleware/middleware.go (Metrics, installed router-wide before routing in internal/server/routes.go), with go-http-metrics v0.13.0, whose method label is the request's method as sent (middleware/middleware.go line 130 in the library). Found while reworking #260.
What is wrong: Go's HTTP server accepts any method name that is a valid token, and the metrics middleware records every request before routing, so each new method name a client sends creates its own series (a duration histogram, a size histogram, an in-flight gauge) that are never dropped. #260 bounds the handler label; the method label stays unbounded.
How it fails: with metrics on (metrics.username and metrics.password set, as the README recommends), an outsider sends requests with a new made-up method each time; each costs one 404 or 405 and leaves new series in memory until a restart.
Severity: medium
Definition of done:
The method label takes the request's method only when it is one of the standard methods (GET, HEAD, POST, PUT, PATCH, DELETE, OPTIONS, CONNECT, TRACE); every other method shares one value.
A test first shows two made-up methods produce one method label value; make check green.
Package: internal/middleware. Starts after #260 lands, which changes the same middleware.
Model: opus-5-5
Where: `internal/middleware/middleware.go` (`Metrics`, installed router-wide before routing in `internal/server/routes.go`), with go-http-metrics v0.13.0, whose `method` label is the request's method as sent (`middleware/middleware.go` line 130 in the library). Found while reworking https://git.eeqj.de/sneak/pixa/pulls/260.
What is wrong: Go's HTTP server accepts any method name that is a valid token, and the metrics middleware records every request before routing, so each new method name a client sends creates its own series (a duration histogram, a size histogram, an in-flight gauge) that are never dropped. https://git.eeqj.de/sneak/pixa/pulls/260 bounds the `handler` label; the `method` label stays unbounded.
How it fails: with metrics on (`metrics.username` and `metrics.password` set, as the README recommends), an outsider sends requests with a new made-up method each time; each costs one 404 or 405 and leaves new series in memory until a restart.
Severity: medium
Definition of done:
1. The `method` label takes the request's method only when it is one of the standard methods (`GET`, `HEAD`, `POST`, `PUT`, `PATCH`, `DELETE`, `OPTIONS`, `CONNECT`, `TRACE`); every other method shares one value.
2. A test first shows two made-up methods produce one `method` label value; `make check` green.
Package: `internal/middleware`. Starts after https://git.eeqj.de/sneak/pixa/pulls/260 lands, which changes the same middleware.
Model: opus-5-5
clawbot
self-assigned this 2026-10-15 11:31:14 +02:00
Plan: the metrics middleware keeps the request's method as the method label only for GET, HEAD, POST, PUT, PATCH, DELETE, OPTIONS, CONNECT and TRACE, and records every other method as other, next to unmatched for the handler label from #260. The metrics library reads the method from the request it is handed, so it gets a copy of the request carrying the label; the handlers behind it still see the method the client sent. README.md names other where it describes the metrics.
A new test, committed before the fix, sends two made-up methods and expects /metrics to count both under one method value. No existing test changes.
Model: opus-5-5
Plan: the metrics middleware keeps the request's method as the `method` label only for `GET`, `HEAD`, `POST`, `PUT`, `PATCH`, `DELETE`, `OPTIONS`, `CONNECT` and `TRACE`, and records every other method as `other`, next to `unmatched` for the `handler` label from https://git.eeqj.de/sneak/pixa/pulls/260. The metrics library reads the method from the request it is handed, so it gets a copy of the request carrying the label; the handlers behind it still see the method the client sent. `README.md` names `other` where it describes the metrics.
A new test, committed before the fix, sends two made-up methods and expects /metrics to count both under one `method` value. No existing test changes.
Model: opus-5-5
Built as planned in #277. The in-flight gauge has no method label, so only the duration and size histograms were affected.
Model: opus-5-5
Built as planned in https://git.eeqj.de/sneak/pixa/pulls/277. The in-flight gauge has no `method` label, so only the duration and size histograms were affected.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Where:
internal/middleware/middleware.go(Metrics, installed router-wide before routing ininternal/server/routes.go), with go-http-metrics v0.13.0, whosemethodlabel is the request's method as sent (middleware/middleware.goline 130 in the library). Found while reworking #260.What is wrong: Go's HTTP server accepts any method name that is a valid token, and the metrics middleware records every request before routing, so each new method name a client sends creates its own series (a duration histogram, a size histogram, an in-flight gauge) that are never dropped. #260 bounds the
handlerlabel; themethodlabel stays unbounded.How it fails: with metrics on (
metrics.usernameandmetrics.passwordset, as the README recommends), an outsider sends requests with a new made-up method each time; each costs one 404 or 405 and leaves new series in memory until a restart.Severity: medium
Definition of done:
methodlabel takes the request's method only when it is one of the standard methods (GET,HEAD,POST,PUT,PATCH,DELETE,OPTIONS,CONNECT,TRACE); every other method shares one value.methodlabel value;make checkgreen.Package:
internal/middleware. Starts after #260 lands, which changes the same middleware.Model: opus-5-5
Plan: the metrics middleware keeps the request's method as the
methodlabel only forGET,HEAD,POST,PUT,PATCH,DELETE,OPTIONS,CONNECTandTRACE, and records every other method asother, next tounmatchedfor thehandlerlabel from #260. The metrics library reads the method from the request it is handed, so it gets a copy of the request carrying the label; the handlers behind it still see the method the client sent.README.mdnamesotherwhere it describes the metrics.A new test, committed before the fix, sends two made-up methods and expects /metrics to count both under one
methodvalue. No existing test changes.Model: opus-5-5
Built as planned in #277. The in-flight gauge has no
methodlabel, so only the duration and size histograms were affected.Model: opus-5-5