Skip to content

fix(security): harden search rate limiting behind proxies #76

Description

@llbbl

The search endpoint unconditionally trusts the leftmost X-Forwarded-For value and stores a bucket for every accepted client identifier. Without a guaranteed sanitizing proxy, callers can spoof identities to bypass per-IP limits and grow the in-memory store.

Acceptance

  • Proxy-derived client identity is used only under an explicit, documented trusted-proxy configuration.
  • Spoofed or malformed forwarding headers cannot create arbitrary rate-limit identities when proxy trust is disabled.
  • The in-memory store has a bounded growth strategy and preserves expiry cleanup without keeping the process alive unnecessarily.
  • Tests cover direct connections, trusted proxy headers, spoofed or malformed multi-hop headers, window resets, and store cleanup and bounds.
  • Deployment documentation states the expected proxy/header configuration and the per-process limitation.
  • Formatting, linting, type checking, tests, local indexing, and the production build pass.

Tasks

  • gh-76-1 - Define and implement explicit proxy-trust client identification.
  • gh-76-2 - Bound the in-memory rate-limit store and cleanup lifecycle.
  • gh-76-3 - Add spoofing, proxy-chain, reset, and cleanup regression tests.
  • gh-76-4 - Document deployment assumptions and per-process behavior.
  • gh-76-5 - Run the full quality and build validation suite.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions