sneak
f32284a39f
All checks were successful
check / check (push) Successful in 2m37s
The public receiver /webhook/{uuid} had no rate limiting: anyone
who learns an entrypoint UUID can flood it, inflating the
per-webhook database and the delivery queue.
Add a dedicated limit scoped to the receiver route, keyed per
client IP per request path (the path contains the entrypoint
UUID), so one misbehaving sender is throttled without affecting
other senders of the same entrypoint or other entrypoints.
Requests over the limit get a 429; httprate adds the Retry-After
header per RFC 6585. IP extraction honours X-Forwarded-For,
X-Real-IP, and True-Client-IP for reverse-proxy deployments.
The limit is RECEIVER_RATE_LIMIT requests per minute, default
120. A set-but-unparseable or non-positive value aborts startup
via the new envPositiveInt strict parser rather than silently
falling back to the default. envInt's other callers are
unchanged; converting them is tracked in #80.
Also update the README env table and Rate Limiting design
section, and sync TODO.md.
104 lines
2.8 KiB
Go
104 lines
2.8 KiB
Go
package middleware
|
|
|
|
import (
|
|
"net/http"
|
|
"time"
|
|
|
|
"github.com/go-chi/httprate"
|
|
)
|
|
|
|
const (
|
|
// loginRateLimit is the maximum number of login attempts
|
|
// per interval.
|
|
loginRateLimit = 5
|
|
|
|
// loginRateInterval is the time window for the rate limit.
|
|
loginRateInterval = 1 * time.Minute
|
|
|
|
// receiverRateInterval is the time window for the webhook
|
|
// receiver rate limit. The configured limit is expressed in
|
|
// requests per minute.
|
|
receiverRateInterval = 1 * time.Minute
|
|
)
|
|
|
|
// LoginRateLimit returns middleware that enforces per-IP rate
|
|
// limiting on login attempts using go-chi/httprate. Only POST
|
|
// requests are rate-limited; GET requests (rendering the login
|
|
// form) pass through unaffected. When the rate limit is exceeded,
|
|
// a 429 Too Many Requests response is returned. IP extraction
|
|
// honours X-Forwarded-For, X-Real-IP, and True-Client-IP headers
|
|
// for reverse-proxy setups.
|
|
func (m *Middleware) LoginRateLimit() func(http.Handler) http.Handler {
|
|
limiter := httprate.Limit(
|
|
loginRateLimit,
|
|
loginRateInterval,
|
|
httprate.WithKeyFuncs(httprate.KeyByRealIP),
|
|
httprate.WithLimitHandler(http.HandlerFunc(
|
|
func(w http.ResponseWriter, r *http.Request) {
|
|
m.log.Warn("login rate limit exceeded",
|
|
"path", r.URL.Path,
|
|
)
|
|
http.Error(
|
|
w,
|
|
"Too many login attempts. "+
|
|
"Please try again later.",
|
|
http.StatusTooManyRequests,
|
|
)
|
|
},
|
|
)),
|
|
)
|
|
|
|
return func(next http.Handler) http.Handler {
|
|
limited := limiter(next)
|
|
|
|
return http.HandlerFunc(func(
|
|
w http.ResponseWriter,
|
|
r *http.Request,
|
|
) {
|
|
// Only rate-limit POST requests (actual login
|
|
// attempts)
|
|
if r.Method != http.MethodPost {
|
|
next.ServeHTTP(w, r)
|
|
|
|
return
|
|
}
|
|
|
|
limited.ServeHTTP(w, r)
|
|
})
|
|
}
|
|
}
|
|
|
|
// ReceiverRateLimit returns middleware that rate-limits the
|
|
// public webhook receiver endpoint per client IP per request
|
|
// path (the path contains the entrypoint UUID, so each sender
|
|
// is limited per entrypoint without affecting other senders or
|
|
// other entrypoints). The limit is Config.ReceiverRateLimit
|
|
// requests per minute. Requests over the limit receive a 429;
|
|
// httprate adds the Retry-After header (RFC 6585). IP
|
|
// extraction honours X-Forwarded-For, X-Real-IP, and
|
|
// True-Client-IP headers for reverse-proxy setups.
|
|
func (m *Middleware) ReceiverRateLimit() func(http.Handler) http.Handler {
|
|
return httprate.Limit(
|
|
m.params.Config.ReceiverRateLimit,
|
|
receiverRateInterval,
|
|
httprate.WithKeyFuncs(
|
|
httprate.KeyByRealIP,
|
|
httprate.KeyByEndpoint,
|
|
),
|
|
httprate.WithLimitHandler(http.HandlerFunc(
|
|
func(w http.ResponseWriter, r *http.Request) {
|
|
m.log.Warn(
|
|
"webhook receiver rate limit exceeded",
|
|
"path", r.URL.Path,
|
|
)
|
|
http.Error(
|
|
w,
|
|
"Too many requests. "+
|
|
"Please slow down.",
|
|
http.StatusTooManyRequests,
|
|
)
|
|
},
|
|
)),
|
|
)
|
|
}
|