auth: no rate limiting on authentication failures #7

New Issue

mathias · 2026-05-14T08:44:12Z

mathias commented

2026-05-14 08:44:12 +00:00

BearerMiddleware returns 401 immediately on failure with no throttling. An attacker can enumerate static tokens or probe for timing differences between JWT and static-token checks without any friction.

File: internal/auth/bearer.go:22-42

Suggestions:

Add per-IP failure rate limiting (e.g. 10 failures/min with exponential backoff) in the middleware
Add a short fixed-duration sleep on failure path to blunt timing-based token enumeration
Return Retry-After header when rate limit is hit

`BearerMiddleware` returns 401 immediately on failure with no throttling. An attacker can enumerate static tokens or probe for timing differences between JWT and static-token checks without any friction. **File:** `internal/auth/bearer.go:22-42` **Suggestions:** - Add per-IP failure rate limiting (e.g. 10 failures/min with exponential backoff) in the middleware - Add a short fixed-duration sleep on failure path to blunt timing-based token enumeration - Return `Retry-After` header when rate limit is hit

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: mathias/gitea-mcp#7