Enrollment: front the unauthenticated create/join endpoints (compensating control for the dropped rate limiter)
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 48/100
- Issue type
- Feature
- Clarity
- Mostly clear
- Activity status
- Active
- Tech stack
- rust
- Domain
- documentation, infrastructure, networking, security
Research direction
Read the enrollment create/join endpoint implementation and deployment configuration to identify how the unauthenticated endpoint is exposed; the issue does not name specific files or tests. Determine whether the gateway or a NetworkPolicy is the appropriate fronting control, and document that the service must not be exposed directly to the public internet. Done means source-level or connection limiting is explicit and the exposure guidance is documented.
Written by the indexing model from the issue text.
Description
The unauthenticated create path runs a CSR signature verify before the invite is checked, so a caller with no valid invite still forces a per-request verify. The in-process rate limiter was deliberately removed: it was net-negative (zero guessing-defense against 256-bit tokens, and a global bucket that 429s every legitimate enrollee under a garbage-token flood).
Body size is capped and a P-256 verify is cheap, so the residual is modest. But the compensating control must be explicit rather than a note: front the enrollment endpoint with the gateway or a NetworkPolicy (connection and source-level limiting), and document that the service is not meant to be raw-internet-facing.
Non-blocking for tech preview.
- Dominant language
- Rust
- Stars
- 10
- Forks
- 24
- Avg merge
- 1d 14h
- Merged PRs (30d)
- 143
Getting set up
- No Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from praxis-proxy/grid
-
area/security triage/accepted
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
praxis-proxy/grid#504 · 1 comment ·
Maintainers usually reply within 1 day
-
triage/needs-triage
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
praxis-proxy/grid#496 ·
Maintainers usually reply within 1 day
-
area/security epic triage/accepted
Difficulty 5/5 Over a week Newbie friendliness 10/100
praxis-proxy/grid#508 ·
Maintainers usually reply within 1 day
-
area/security triage/accepted
Difficulty 4/5 3-5 days Newbie friendliness 45/100
praxis-proxy/grid#507 · 1 comment ·
Maintainers usually reply within 1 day
-
area/security triage/accepted
Difficulty 4/5 3-5 days Newbie friendliness 45/100
praxis-proxy/grid#506 · 1 comment ·
Maintainers usually reply within 1 day
All issues in praxis-proxy/grid
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
longbridge/nsh#804 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
Maintainers usually reply within 1 day
-
devex good first issue
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
calcit-lang/calcit#2538 ·
Maintainers usually reply within 1 day