Which endpoints need a rate limit, and where the limit lives #104

New Issue

2026-09-21T07:18:31Z

cgalo5758 commented

2026-09-21 07:18:31 +00:00

The question

The console has no rate limiting of its own. Sign-in is delegated to the identity provider, which limits attempts itself, so the question is which of the console's own endpoints can be driven hard enough to matter, and whether the limit belongs in the console or in the reverse proxy in front of it.

What depends on the answer

The candidates are the unauthenticated endpoints: the certificate ask the TLS proxy calls for every unknown name, the webhook receivers, and the sign-in callback; and the authenticated ones that cost money or send mail: checkout and site creation. Each has a different attacker and a different cost, so one global limit is the wrong shape.

Options known so far

A limit per endpoint in the console's middleware, keyed by client address or by session.
Limits in the reverse proxy only, documented as part of deployment, with the console doing nothing.
No limit where the upstream already has one, and a console-side limit only on the endpoints that cost money.

Decided when

The deployment doc states which endpoints are limited, by whom, and at what rate, and the console implements whatever share of that is its own.

Migrated from status/issues.md at b7a0e15

## The question The console has no rate limiting of its own. Sign-in is delegated to the identity provider, which limits attempts itself, so the question is which of the console's own endpoints can be driven hard enough to matter, and whether the limit belongs in the console or in the reverse proxy in front of it. ## What depends on the answer The candidates are the unauthenticated endpoints: the certificate ask the TLS proxy calls for every unknown name, the webhook receivers, and the sign-in callback; and the authenticated ones that cost money or send mail: checkout and site creation. Each has a different attacker and a different cost, so one global limit is the wrong shape. ## Options known so far - A limit per endpoint in the console's middleware, keyed by client address or by session. - Limits in the reverse proxy only, documented as part of deployment, with the console doing nothing. - No limit where the upstream already has one, and a console-side limit only on the endpoints that cost money. ## Decided when The deployment doc states which endpoints are limited, by whom, and at what rate, and the console implements whatever share of that is its own. Migrated from status/issues.md at b7a0e15

cgalo5758 added the

kind

design

area/identity area/ops security labels 2026-09-21 07:18:31 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: wiki-cafe/member-console#104