[I] Rate-limit JWT-authenticated requests by user (tooling-trusted-releases)

["sbp (via GitHub)" <gi...@apache.org>]

sbp opened a new issue, #1658:
URL: https://github.com/apache/tooling-trusted-releases/issues/1658

   The rate limit key function checks for a web session (`sql.UserSession`) to key by `user:{asf_uid}`, but API requests authenticated via JWT Bearer tokens do not create a web session. These requests fall through to the `ip:{remote_addr}` key, meaning all API users sharing an IP address (corporate NAT, CI/CD runner pools) share the same rate limit bucket on sensitive endpoints (e.g., 10/hr on `/api/jwt/create`).


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@tooling.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] Rate-limit JWT-authenticated requests by user (tooling-trusted-releases)

["alitheg (via GitHub)" <gi...@apache.org>]

alitheg closed issue #1658: Rate-limit JWT-authenticated requests by user
URL: https://github.com/apache/tooling-trusted-releases/issues/1658


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@tooling.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] Rate-limit JWT-authenticated requests by user (tooling-trusted-releases)

["alitheg (via GitHub)" <gi...@apache.org>]

alitheg commented on issue #1658:
URL: https://github.com/apache/tooling-trusted-releases/issues/1658#issuecomment-5949692057

   I've implemented this but couldn't use `g.jwt_claims` because they're not set yet in the limiter, and I didn't limit `/api/jwt/create` since adding a per-user limit on that, which is the PAT exchange endpoint, would allow anyone to lock a user out by spamming PAT requests. It shouldn't be a heavily used endpoint so I don't think it's bad having it IP limited only. If we do want to, we could limit by user *and* IP but I think it's unnecessary.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@tooling.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org