Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

host: /api rate limit is easy to hit and shows up as "signed out" in the UI

Aperta
  • Qualcosa non va?
#634 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
45/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
typescript
Ambito
api, backend, security

Direzione di ricerca

Start by reading the host's SecurityMiddleware configuration and tracing how 429 responses from /api/auth/get-session reach the UI. Reproduce with bos dev and repeated page loads; the issue names no source files or tests, so locate the middleware and UI handling first. Done means rate limiting no longer creates misleading signed-out or not-found states, with behavior for shared IPs and trusted proxy headers addressed.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

The host's SecurityMiddleware (hono-rate-limiter) limits /api/* to RATE_LIMIT_MAX (300) requests per RATE_LIMIT_WINDOW_MS (900000, 15 min) per IP. The key is the first x-forwarded-for entry, else the socket IP, and the store is in-memory.

That's lower than it looks. A nearbuilders.org page load makes about 9 API calls signed out and more signed in, so 20–30 page loads in 15 minutes trips it. bos dev loads the same host bundle, so it hits local dev too, where all traffic comes from 127.0.0.1.

What happens when it trips: /api/auth/get-session returns 429 along with everything else. The UI treats that as no session, so the user looks signed out, and project pages show "Project not found". Nothing says it's a rate limit.

Repro (local):

  1. bos dev in nearbuilders.org, sign in.
  2. Click around / reload ~30 times within 15 minutes.
  3. /api/* calls start returning 429; the header shows signed out and project pages say "Project not found".

Other concerns:

  • People behind one IP (city node events, offices, conference wifi) share one bucket, so one busy room can lock everyone out.
  • The first x-forwarded-for entry is set by the client, so anyone can pick a fresh key per request and skip the limit. The rightmost entry added by the trusted proxy is the safer one.
  • In-memory store means the limit is per instance and resets on restart.

Suggestions:

  • Raise the default, or key signed-in requests by session/user and fall back to IP only when signed out.
  • Exempt /api/auth/get-session (or give it its own, higher limit).
  • Handle 429 in the UI: show a "too many requests, try again shortly" message instead of signed-out / not-found states.
  • Take the client IP from the trusted proxy hop, not the first x-forwarded-for value.
  • Document RATE_LIMIT_MAX / RATE_LIMIT_WINDOW_MS for local dev (setting RATE_LIMIT_MAX=5000 in .env works around it).
Lingua principale
TypeScript
Stelle
5
Fork
3
Merge medio
9h 37m
PR unite (30g)
157

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di NEARBuilders/everything-dev

Tutte le issue di NEARBuilders/everything-dev

Issue simili

Altre issue su TypeScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.