Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Rate limiter is keyed on ip:port, so limits apply per connection instead of per client IP

Open Beginner friendly
  • Is something wrong?
#635 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 4 days

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
82/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
go
Domain
backend, security

Research direction

Start in src/backend/server/server.go and find the GetLimiter call sites used by the rate-limited handlers. Add a regression test that exhausts the burst from 1.2.3.4:1000 and expects a 429 from 1.2.3.4:2000; then verify the limit is keyed by client IP across connections and the test passes.

Written by the indexing model from the issue text.

Description

bug

Problem

Every rate-limited handler in src/backend/server/server.go (logsHandler, mappingsHandler, statsHandler, handlePIICheck, …) does:

ip := r.RemoteAddr
limiter := s.rateLimiter.GetLimiter(ip)

r.RemoteAddr is host:port, and the port is the client's ephemeral source port. Each new TCP connection from the same client gets a new port, so it gets a fresh limiter with a full burst. In practice, the NewRateLimiter(10, 20) limit only applies within a single keep-alive connection. A client that opens new connections gets past it.

Spotted while reviewing #611. Its tests reuse a fixed RemoteAddr such as "8.8.8.8:1234", which hides the problem.

Suggested fix

  • Add a small helper, e.g. clientIP(r *http.Request) string, that uses net.SplitHostPort(r.RemoteAddr) and falls back to RemoteAddr if that returns an error. Use it at every GetLimiter call site.
  • Don't trust X-Forwarded-For by default. The server listens locally, and the header is easy for a client to spoof.
  • Add a regression test: use up the burst from 1.2.3.4:1000, then expect a 429 from 1.2.3.4:2000.
Dominant language
Go
Stars
438
Forks
51
Avg merge
3d 2h
Merged PRs (30d)
4

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from dataiku/kiji-proxy

All issues in dataiku/kiji-proxy

Similar issues

More Go issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.